Webhook Verification Failures

Check:

• You are using the raw body exactly as received.
• You are using SHA-256(signingSecret) as the HMAC key.
• The timestamp is within tolerance.
• The signature header includes v1=.
• The event ID in the signed material matches sparelane-event-id.

Do not use the plaintext secret directly as the HMAC key for this sandbox contract.