In plain language
It proves the webhook really came from the expected app and was not tampered with in transit.
Example
A payment provider sends a signature header; the workflow recomputes it with the shared secret and rejects the event if they do not match.
Related terms
Webhook · Payload · API Key · Idempotency
Common misconception
A secret webhook URL is not a substitute for signature checks; URLs leak through logs, screenshots, and shared configs.
Implementation guidance
Verify the signature against the raw body, compare in constant time, reject old timestamps to stop replays, and rotate secrets periodically.