The agent app's webhook signing secret.
The exact request bytes. Passing a re-serialized string only works when it matches the original bytes, so prefer the raw body.
The Payload-Signature header value.
false for a missing, malformed, or mismatched signature.
Verifies a Shortcut webhook signature in constant time using WebCrypto, which is available on Node.js 20+, Cloudflare Workers, Deno, and Bun.