Support signed inbound webhook requests

Summary

Customers want Aha! to validate signed inbound webhook requests so they can trust that incoming webhook payloads came from the configured sender and were not tampered with in transit.

Why this matters

Security and architecture reviews may block adoption when inbound webhook endpoints accept unsigned requests. Supporting signed request validation would give teams a clear way to reduce spoofing risk and meet enterprise security requirements.

Expected behavior

• Allow admins to configure a shared secret for an inbound webhook

• Allow admins to specify which signature header should be validated

• Verify the request signature using HMAC-SHA256 against the raw request body

• Reject requests with missing or invalid signatures before processing

• Support secret rotation with a short overlap period to avoid downtime

Customer benefit

This would make inbound webhook integrations easier to approve in enterprise environments and give customers more confidence in using automation that depends on external systems sending data into Aha!.