Ensures webhook integrity by verifying raw body, HMAC-SHA256 signatures, timestamp windows, and atomic delivery deduplication.

The agent implements verification logic for AI agent webhook callbacks. It checks the raw body against an HMAC-SHA256 signature, validates the timestamp window to prevent replay attacks, uses constant-time comparison for security, and ensures atomic delivery deduplication to handle duplicate notifications safely.

• Category: Software development
• Effect: Read-only
• MCP servers: ActionDock MCP (https://koskamo.com/explore/actiondock-mcp)
• Source: Field notes — ActionDock (https://actiondock.app/blog)
• Source quote: "Verify AI-agent webhook callbacks with the raw body, HMAC-SHA256, a timestamp window, constant-time comparison, and atomic delivery deduplication."
• Playbook page: https://koskamo.com/explore/use-cases/verify-webhook-callbacks-for-ai-agents

Prompt: Implement verification for AI agent webhook callbacks. Check the raw body with HMAC-SHA256, validate the timestamp window, use constant-time comparison, and ensure atomic delivery deduplication.