Design a security model for receiving webhooks from a third-party service (e.g., a payment provider) that can't participate in your normal OAuth2/session-based authentication.

Webhooks typically can't complete an interactive login flow, so authenticate them differently: verify an HMAC signature the provider computes over the raw request body using a shared secret, sent in a custom header (e.g., X-Signature) — the endpoint recomputes the HMAC and rejects the request on any mismatch. This endpoint should be explicitly excluded from CSRF (no session involved) but must still validate the signature on every single call, and should reject replayed requests using a timestamp + nonce check.