Webhook signing

Events are signed with HMAC-SHA256 over the exact raw body, written as hex, using the shared signing secret.

• Signature header: put only the header name in the field, for example X-ReGen-Signature. Notes like "HMAC-SHA256, hex" describe it and do not belong in the field.
• If no header name is set, the shared secret itself is sent.
• Asembla signs every outbound event the same way, for example in X-PEP-Signature.

signature = hex( HMAC_SHA256( secret, raw_request_body ) )