O resultado chega onde o trabalho acontece.

# Python, valide SEMPRE, antes de olhar o corpo
import hmac, hashlib

def valida(corpo: bytes, cabecalho: str, segredo: str) -> bool:
    esperado = "sha256=" + hmac.new(
        segredo.encode(), corpo, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(esperado, cabecalho)


# Node
const esperado = "sha256=" + crypto
  .createHmac("sha256", segredo)
  .update(corpoCru)          // o corpo CRU, antes do JSON.parse
  .digest("hex")

crypto.timingSafeEqual(Buffer.from(esperado), Buffer.from(assinatura))

curl -X POST https://api.voicespeak.app/v1/webhooks \
  -H "Authorization: Bearer sk_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://crm.suaempresa.com/hooks/voicespeak",
    "eventos": ["conversa.encerrada",
                 "gravacao.pronta",
                 "interacao.resumida"],
    "segredo": "…"
  }'

# testar antes de depender disso:
curl -X POST https://api.voicespeak.app/v1/webhooks/{id}/testar \
  -H "Authorization: Bearer sk_live_…"