How webhook signatures work
A webhook sender and your server share a secret. For every delivery the sender computes an HMAC of the request body with that secret and puts it in a header. Your server computes the same HMAC from the body it received and compares the two. When they match, the delivery came from someone who knows the secret and the body was not changed on the way.
Sign the raw bytes
The HMAC covers the exact bytes of the body. If your framework parses the JSON and you encode it again, the spacing, key order or escaping can change, and the signature no longer matches. Read the raw body before any parsing, and compare in constant time (hash_equals in PHP, hmac.compare_digest in Python, crypto.timingSafeEqual in Node).
PostBoost webhooks
When a webhook has a secret (webhooks created over the API always have one), PostBoost signs every delivery with HMAC-SHA256 of the raw body and sends it as a hex string in X-Signature. A secret is optional for webhooks added in the app. The sample deliveries above use the secret whsec_test so you can see a valid result first, then change one character and watch the hints. Server code for Python and Node is in the webhooks docs, and you can create a webhook from the API or the app.
What the hints check
When a signature is invalid, the verifier tries one fix at a time: strip a prefix such as sha256=, drop a trailing newline, trim spaces around the secret, switch hex and base64, try the other algorithms, and re-encode the JSON the two common ways. Every hint you see is one of those checks that turned the result valid.