To allow api users to verify the authenticity of outgoing webhooks, I am using a similar model to slack:
Concatenate timestamp and body, HMAC with pre-shared key, add timestamp and HMAC digest to headers.
Recipient does the same, and compares to the digest in the header.
I can either implement this exclusively on outgoing webhooks, or I can implement it as middleware that performs this process on both outgoing webhooks, and responses to requests.
Is doing the latter good practice? A good idea?