Receive Firecrawl crawl/batch results via webhooks instead of polling, with HMAC signature verification

Documented steps

1. AUTH: Webhook deliveries are authenticated by the X-Firecrawl-Signature: sha256=<hex> header verified against your per-account webhook secret (dashboard Advanced settings) — not the API bearer token
2. In the POST /v2/crawl (or batch scrape) body add: "webhook": {"url":"https://your-domain.com/webhook","headers":{...},"metadata":{"job":"nightly-sync"},"events":["started","page","completed"]}
3. Your endpoint must be HTTPS and answer 2xx within 10 seconds or the delivery counts as failed
4. Delivery shape: {"success":bool,"type":"crawl.started"|"crawl.page"|"crawl.completed","id":"<jobId>","data":[...],"metadata":{...}}
5. crawl.page fires once per scraped page; crawl.completed signals the job is done; extract/agent jobs use analogous event families (extract.started/completed/failed etc.)
6. Verify authenticity: compute HMAC-SHA256 over the RAW request body with your webhook secret and timing-safe-compare against X-Firecrawl-Signature (crypto.timingSafeEqual / hmac.compare_digest)
7. Reject on signature mismatch BEFORE parsing/processing the payload