Headers
X-Lucion-Webhook-Id: evt_REDACTED
X-Lucion-Webhook-Timestamp: 1760000000
X-Lucion-Webhook-Signature: v1,BASE64URL_HMAC
Idempotency-Key: <event-id>:<subscription-id>Reject timestamps outside the five-minute window, invalid signatures, non-HTTPS delivery assumptions, and duplicate event/subscription pairs. Lucion does not follow destination redirects. The official TypeScript, Python, and Go SDKs include portable helpers that verify the raw body before parsing.