title: PHP - Setup Webhook Receiver with signature verification
body: <p>I need to setup a PHP page for receiving Webhooks - I've done many of these in the past so that is not a problem, but the API I'm working with for this project requires that my webhook verifies the signature provided in the header.</p>
  
  <p>As part of the validation request it will send the following:</p>
  
  <pre><code>HEADER:
   "x-xero-signature" : HASH_VALUE
  PAYLOAD:
  {
     "events": [],
     "lastEventSequence": 0,
     "firstEventSequence": 0,
     "entropy": "S0m3r4N0m3t3xt"
  }
  </code></pre>
  
  <p>I've created a Webhook key (e.g. 'ABC123'), and as part of the validation request for this Webhook I must ensure that the payload which is hashed using HMACSHA256 with your webhook key and base64 encoded should match the signature in the header. This is a correctly signed payload. If the signature does not match the hashed payload it is an incorrectly signed payload.</p>
  
  <p>To gain Intent to Receive validation, the receiving url must respond with status: 200 Ok for all correctly signed payloads and respond with status: 401 Unauthorized for all incorrectly signed payloads. </p>
  
  <p>I'm a bit lost at this point as to how to go about this - the details for this setup can be found here:</p>
  
  <p><a href="https://developer.xero.com/documentation/getting-started/webhooks" rel="noreferrer">https://developer.xero.com/documentation/getting-started/webhooks</a></p>