<?php
$expected_secret = 'the secret shown on the endpoint detail page';
$received_secret = $_SERVER['HTTP_X_WEBHOOK_SECRET'] ?? '';

if (!hash_equals($expected_secret, $received_secret)) {
    http_response_code(401);
    exit;
}

$payload = json_decode(file_get_contents('php://input'), true);
// ... handle $payload['event'] / $payload['data']

// Node / Express
app.post('/webhooks/growcrm', (req, res) => {
  const expected = process.env.GROWCRM_WEBHOOK_SECRET;
  const received = req.header('X-Webhook-Secret');

  if (!received || received !== expected) {
    return res.sendStatus(401);
  }

  const { event, id, data } = req.body;
  // ... handle the event
  res.sendStatus(200);
});