Verify against the original request body before parsing or changing it, using the signature rules for your chosen webhook contract. Native and Meta-compatible webhook contracts must not be mixed. A correct secret with a modified body can still fail verification.
Check the header name, selected contract, and active signing configuration. Keep signature verification enabled while investigating. Use a redacted test to show support the event type, time, and verification error; do not include the signing secret. Accepting every request to silence the error would expose your receiver to untrusted input.