Each request carries Pagerless-Signature: t=<unix time>,v1=<HMAC-SHA256>. Compute the HMAC of t + "." + body with your webhook secret and compare it in constant time; reject old timestamps.
import { createHmac, timingSafeEqual } from "node:crypto";
function verify(header, body, secret) {
const { t, v1 } = Object.fromEntries(header.split(",").map((p) => p.split("=")));
const mac = createHmac("sha256", secret).update(`${t}.${body}`).digest("hex");
return Math.abs(Date.now() / 1000 - Number(t)) < 300 && timingSafeEqual(Buffer.from(mac), Buffer.from(v1));
}