Implement and validate webhook signature verification for multiple IDV providers

Steps

1. For each IDV provider, retrieve the shared webhook secret from the provider's dashboard and store it securely in your secrets manager, never in source code
2. In your webhook handler, read the raw request body as bytes before any JSON parsing, since signature computation uses the exact raw payload
3. Compute the expected signature using the algorithm specified by each provider (commonly HMAC-SHA256 over the raw body using the shared secret)
4. Compare the computed signature against the value in the provider-specific signature header using a constant-time comparison function to prevent timing attacks
5. Reject the request with a 401 response immediately if the signature does not match, without processing any payload data
6. Implement a replay attack defense by checking a timestamp field in the payload against the current time and rejecting events that are too old (typically more than five minutes)