Verifying webhook signatures

Headers we send:

• X-Clustrix-Signature: t=TIMESTAMP,v1=HASH
• X-Clustrix-Event
• X-Clustrix-Delivery-Id

Verify it

$expected = hash_hmac("sha256", $rawBody, $signingSecret);\nif (!hash_equals($expected, $providedHash)) abort(400);