Verifying a Payload

Calculate the signature from the exact raw request bytes before parsing JSON. Compare the result with X-Connect-Signature using a constant-time comparison, then enforce a bounded timestamp window and a one-time nonce policy.