#webhooks

HMAC on a webhook is not authorization for the side effects

Verifying an HMAC (or signature header) proves the request came from the provider you trust. It does not decide what that event is allowed to change inside your product. After the signature checks out