How is the webhook secured?
The webhook URL embeds a key that is shown once and stored only as a SHA-256 hash. Every request is authenticated, rate-limited and scoped to your shop alone, and you can rotate the key at any time — the old URL stops working the moment you do.
