Constant-time comparison
Comparing two secrets in a way whose duration does not reveal how much matched.
What it means
An ordinary string comparison stops at the first difference, so a timing measurement can leak how many leading characters were right. A constant-time comparison always takes the same time.
How Onekey handles it
When you verify a webhook signature, compare in constant time: hmac.compare_digest in Python, crypto.timingSafeEqual in Node. The verification snippets in the docs do exactly that.