Deploy first, debug later.
Webhook signatures, locally.
Tools/Generate & test
Secret stays in your browser. Use test keys only.