Every delivery is signed with HMAC-SHA256 over the raw body using your subscription's secret. Verify in your handler:

expected = hmac_sha256(secret, request.body).hex()
sig      = request.headers["X-Webhook-Signature"].lstrip("sha256=")
if not constant_time_compare(expected, sig):
    reject(401)