The concept

HMAC is a code calculated from the content of the message and a secret key that only the platform and you know. It travels in a header, alongside the webhook.

On your end, you recalculate the same code with the same key and compare them. If they match, the notification is legitimate and no one altered the data along the way. If they don't match, you discard it.

Without this check, anyone who discovers your webhook's address could send a fake approved-sale notification and unlock access to your product for free.

How it shows up in practice

Your webhook receives a sale approval notification coming from the platform. But what if someone discovers your webhook address and sends a fake notification? You verify the HMAC using the secret key that only you and the platform know. If it doesn't match, you discard it.

Demonstrate to people that you can help them by actually helping them.

Frank Kern Source: the author's material on Intent-Based Branding.

HMAC is a cryptographic signature that proves the webhook came from the platform and nobody altered the data. Without this verification, anyone can send a fake sale notification and you'd give free access. With it, you know only legitimate notifications pass through.