Subscribe to Workable v3 candidate stage-change webhook events and verify signatures

Steps

1. Generate a Workable API access token under Settings > Integrations > API Access Tokens with the r_candidates scope; use base URL https://{subdomain}.workable.com/spi/v3.
2. POST to /subscriptions with a JSON body specifying the target URL, the event type (e.g., candidate_moved), and optionally a job shortcode or stage to narrow the filter.
3. Receive incoming webhook POSTs at your registered URL; Workable signs each request with HMAC-SHA256 over the raw request body using either the account token or OAuth application secret as the key, and sends the digest in the X-Workable-Signature header.
4. Verify the signature by recomputing HMAC-SHA256 of the raw body with your signing key and comparing it to X-Workable-Signature using a constant-time comparison to prevent timing attacks.
5. Respond with HTTP 200 promptly; Workable retries failed deliveries, so process heavy work asynchronously and return 200 before doing so.