Gymdesk signs every outbound webhook to the
Standard Webhooks specification. Verify the
signature before you trust a payload. Libraries that follow that specification work
unchanged.
Your signing secret starts with whsec_. The rest is base64 key material.
Gymdesk signs the string {id}.{timestamp}.{body}, where id is the webhook event ID
and body is the exact raw request body. The signature is v1, followed by the base64
of an HMAC-SHA256 over that string.
Verify the raw body before you parse it. If you re-serialize the JSON first, the bytes
change and the signature no longer matches.
id, event, occurredAt, actor, and data.
actor is one of member, manager, or system.
The Endpoints tab lists each event and its payload. 
