Verifying webhook signatures

Headers we send:

• X-Premium Hosting-Signature: t=TIMESTAMP,v1=HASH
• X-Premium Hosting-Event
• X-Premium Hosting-Delivery-Id

Verify it

$expected = hash_hmac("sha256", $rawBody, $signingSecret);\nif (!hash_equals($expected, $providedHash)) abort(400);