E0017

A webhook was refused because its signature doesn't match or its timestamp is more than 5 minutes from now.

Erroneous example:

$ curl -X POST https://api.crabtalk.ai/services/you/inbox/webhooks/hook -d @event.json \
    -H "webhook-id: msg_1" -H "webhook-timestamp: 1614265330" -H "webhook-signature: v1,AAAA"
{"error":"stale signature","explain":"E0017"}

The signature is HMAC-SHA256 over {id}.{timestamp}.{body}, the body byte for byte as sent, with the service's WEBHOOK_SECRET. Nothing ran.

To deliver it:

• Check that WEBHOOK_SECRET is the secret this sender signs with, and that nothing rewrites the body on the way.
• Check the sender's clock, and send a replayed event with a fresh timestamp and signature.