Each delivery is a POST with a JSON body and three signature headers:

• X-Taskade-Signature: sha256=<hex>, the HMAC-SHA256 of the raw body, keyed with your secret.
• X-Taskade-Timestamp: the send time, in unix seconds.
• X-Taskade-Signature-V2: sha256=<hex>, the HMAC-SHA256 of <timestamp>.<raw body>, keyed with your secret.

To verify V2:

1. Read the raw request body before you parse the JSON.
2. Compute the HMAC-SHA256 of the X-Taskade-Timestamp value, a period (.) and the raw body. Use your secret as the key.
3. Compare sha256=<your hex> with X-Taskade-Signature-V2 in constant time.
4. Reject the request if the timestamp is more than 5 minutes away from your clock.

The timestamp is part of the signed data, so a captured delivery fails the check after 5 minutes. A copy that arrives inside those 5 minutes still passes, so make your handler idempotent, or record each delivery that you process and skip a repeat. X-Taskade-Signature does not change, and receivers that verify it keep working.