Webhooks

// Vérification (PHP)
[$t, $v1] = explode(',', $signatureHeader);
$timestamp = substr($t, 2); $signature = substr($v1, 3);
$expected = hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);
abort_unless(hash_equals($expected, $signature), 400);

Retentatives espacées (1 min → 12 h, 10 essais). Un event_id stable permet d'ignorer les doublons.