$payload   = json_encode($requestData);
$signature = hash_hmac('sha256', $payload, $signKey);

$headers = [
    'Content-Type: application/json',
    'Authorization: Bearer ' . $apiKey,
    'Signature: ' . $signature,
];

// Send the SAME $payload you signed:
curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);

$raw  = file_get_contents('php://input');
$data = json_decode($raw, true);

// Rebuild the canonical form — do NOT hash $raw
$canonical = json_encode($data, JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT);
$expected  = hash_hmac('sha256', $canonical, $signKey);

if (!hash_equals($expected, $_SERVER['HTTP_SIGNATURE'] ?? '')) {
    http_response_code(401);
    exit;
}

http_response_code(200); // acknowledge