Question 1

How do I verify a webhook signature?

Accepted Answer

Every outbound event is signed with HMAC-SHA256 over the timestamp and body. Recompute it with your signing secret and reject anything outside the replay window.

Question 2

Can I replay an event?

Accepted Answer

Yes. A replay keeps the payload but receives a new delivery ID and a REPLAY marker so your handler can tell it apart.

Question 3

Can the lab reach private networks?

Accepted Answer

No. Private and internal addresses and cloud metadata endpoints are blocked by default.