Use the correct scheme
Message outgoing webhooks send X-Message-Signature in the form t=<unix timestamp>,v1=<hex signature>. The signature is HMAC-SHA256 of the timestamp, a period and the exact raw request body, using the endpoint secret as the key.
Check before parsing
Capture the raw body, validate the signature with a constant-time comparison and reject timestamps outside your replay window. A five-minute window is the documented example. Do not hash re-serialized JSON or use the Verify API key as the webhook secret.
Store the secret
Save the endpoint secret securely when it is issued. There is no promised 24-hour dual-secret rotation window. Provider-to-Message email and phone callbacks use their own schemes; they are not the same as Message webhooks sent to your application.
Use the developer example
See https://www.message.com/developers/webhooks/signature-verification for the outgoing verification example and the distinction between outbound events and provider callbacks.
Keep going
Put the next step into practice, or ask us about your setup.