curl -s -X POST https://app.bizbionic.com/rpc \
  -H "Authorization: Bearer $BB_PARTNER_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"partner.configureWebhook","params":{"webhook_url":"https://partner.example.com/hooks/bizbionic","webhook_secret":"whsec_replace"}}'

curl -s -X POST https://app.bizbionic.com/rpc \
  -H "Authorization: Bearer $BB_PARTNER_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":2,"method":"partner.processOutbox","params":{"limit":20}}'

X-BizBionic-Signature: t=<unix_seconds>,v1=<hex_hmac_sha256>

{timestamp}.{raw_body}

import crypto from 'node:crypto';

function verify(secret, rawBody, header, toleranceSec = 300) {
  const m = /t=(\d+),v1=([a-f0-9]+)/i.exec(header || '');
  if (!m) return false;
  const t = parseInt(m[1], 10);
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - t) > toleranceSec) return false;
  const expected = crypto.createHmac('sha256', secret).update(`${t}.${rawBody}`).digest('hex');
  return expected === m[2].toLowerCase();
}