Webhook signature
A value that proves a webhook came from the sender and was not altered.
What it means
Anyone can send a request to your webhook URL. A signature, computed with a secret only you and the sender know, lets you check the request is genuine.
How Onekey handles it
Each delivery has an Onekey-Signature: t=<unix seconds>,v1=<hex> header, where v1 is HMAC-SHA256 of "<t>." + raw body under your webhook secret. Recompute it over the raw bytes, compare in constant time and refuse a t more than 300 seconds from your clock. The secret is shown once at creation and can be rotated.