PHP: Verificar se a Signature do Webhook da Svelve é válida

hmac_validate.php

<?php

/**
 * Verify the signature of a signed request.
 *
 * @param string $signature The signature parameter from the request.
 * @param string $payload The payload to verify.
 * @param string $token The signing token.
 * @return boolean
 */
public static function verifySignature(string $signature, string $payload, string $token): bool
{
    $computedSignature = hash_hmac('sha256', $payload, $secret);

    return hash_equals($signature, $computedSignature);
}