Signature header
Webhook deliveries include a signature in the form X-Offerwall-Ad-Signature: sha256=<HMAC_SHA256(raw_body, secret)>.
Verify the raw body
Compute the HMAC over the exact raw request body before JSON parsing or normalization, then compare using a timing-safe comparison.
Idempotency
Also store the event or conversion identifier you have already processed so a retried webhook does not reward the same end user twice.