Verifying a callback signature

Every callback we send carries a Signature header — HMAC-SHA256 of the payload, lowercase hex, keyed with your sign key.

This works the opposite way to the requests you send us. When you call the API we hash the raw body exactly as received. For callbacks you must not hash the bytes you receive: the signature is computed over a canonical rendering of the payload, while the HTTP body is serialized separately with different options. The two are never byte-identical, so hashing the received body always fails.