Run the Increase webhook event lifecycle: create an event subscription, verify signatures, and implement cursor-based event polling as a backstop

Steps

1. Create an Event Subscription via the Increase dashboard or POST to the event-subscriptions API endpoint, specifying your publicly accessible HTTPS callback URL and optionally filtering to a single event category.
2. For each inbound webhook POST, extract the webhook-id, webhook-timestamp, and webhook-signature headers; these follow the Standard Webhooks specification.
3. Verify the signature by concatenating webhook-id + '.' + webhook-timestamp + '.' + raw_request_body, computing HMAC-SHA256 with your endpoint's signing secret, Base64-encoding the result, and prepending 'v1,'.
4. Compare the computed signature to the webhook-signature header value using constant-time comparison, and reject requests where webhook-timestamp is older than 5 minutes.
5. To recover from outages, poll the List Events API ordered by oldest-first using order_by.field=created_at&order_by.direction=ascending and persist the next_cursor across runs.
6. When the response data array is empty you have reached the most recent event; store the current next_cursor to resume at the next poll cycle.