Signature check on the payment webhook

Your payment provider calls this endpoint for every charge event, about 50,000 a day, and the handler marks the order paid. The provider signs each request body with a secret you share with it and sends the result, a hex HMAC (a keyed hash of the body), in the X-Signature header.

What do you flag before this ships?