Verify Housecall Pro webhook payload signatures before trusting inbound events

Steps

1. Register a webhook URL in the Housecall Pro dashboard/API and select which event types to subscribe to
2. Save the signing secret Housecall Pro returns at webhook-creation time — this is what you'll use to validate future payloads, not a value you choose yourself
3. On each inbound webhook request, read the signature header Housecall Pro attaches and compute your own signature over the raw request body using the stored secret
4. Compare signatures using a constant-time comparison and reject/return an error for any request whose computed signature doesn't match
5. Only parse and act on the JSON payload after signature verification passes
6. Handle retries/duplicate deliveries idempotently, keyed off the event's unique identifier rather than assuming each event arrives exactly once