How do I confirm a request really came from SureTake?

Each request carries an X-Webhook-Signature header, an HMAC-SHA256 of the raw request body, signed with your endpoint's secret (shown once when you create the endpoint; rotate it anytime). Recompute it on your end and compare. A match proves the request is genuine and untampered:

// Node.js: verify the request really came from SureTake
const crypto = require("crypto");

const signature = req.headers["x-webhook-signature"];
const expected = crypto
  .createHmac("sha256", YOUR_ENDPOINT_SECRET)   // the secret shown when you created the endpoint
  .update(rawRequestBody)                        // the raw body bytes, before JSON.parse
  .digest("hex");

const valid =
  signature &&
  crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
// if !valid -> reject the request

The request also includes an X-Webhook-Event header (recording.ready). Verifying is optional but recommended for anything sensitive. Most no-code tools (Zapier/Make) skip it and simply trust the URL, which is fine if you keep the URL private.