How can my app check that a webhook call really came from my store?

Every webhook call carries a signature made with the Signing secret you copied when you created the webhook. Your developer checks it like this:

1. Read three headers from the request: X-Wcart-Event, X-Wcart-Timestamp and X-Wcart-Signature.
2. Join the timestamp, a full stop, and the raw request body exactly as received.
3. Make an HMAC-SHA256 of that text using the signing secret, written as hex.
4. Accept the call only if it matches X-Wcart-Signature.

The request body is JSON with three fields: event, payload (the order or customer details) and id, a unique delivery ID your app can use to ignore a repeat.

Your app should answer with a success code within 10 seconds, or Wcart will retry.