X-GA-Webhook-Delivery: <uuid>
X-GA-Webhook-Timestamp: 2026-05-28T12:03:11Z
X-GA-Webhook-Signature: sha256=<hex(hmac(secret, rawBody))>
Content-Type: application/json

const crypto = require("crypto");
function verify(rawBody, headerSig, secret) {
  const expected =
    "sha256=" + crypto.createHmac("sha256", secret)
                      .update(rawBody)
                      .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(headerSig),
  );
}

import hmac, hashlib

def verify(raw_body: bytes, header_sig: str, secret: str) -> bool:
    expected = "sha256=" + hmac.new(
        secret.encode("utf-8"),
        raw_body,
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(expected, header_sig)

Day 0  : primary=A  secondary=(none)
Day T  : rotate            -> primary=B  secondary=A   (72h grace window)
Day T+72h: window closes   -> primary=B  secondary=(none)

During the grace window every delivery is signed twice with both A and B
(in separate X-GA-Webhook-Signature- headers). Receivers may accept either.

curl -X POST \
  -H "Authorization: Bearer gaf_pk_<your-token>" \
  -H "X-Org-Id: <your-organization-uuid>" \
  https://api.gaflight.io/api/v1/public/events/evt_01HZ.../replay