Callback signature comes to your endpoint in the header X-SIGNATURE, and in X-TIMESTAMP comes timestamp. To verify the signature use struct Signer, verify method. Example of simple HTTP server for handling callback.
const std = @import("std");
const http = std.http;
const json = std.json;
const signer = @import("signer.zig");

fn handleCallback(allocator: std.mem.Allocator, req: *http.Server.Request) !void {
    const callback_key = "gIUWsQvafc4YGDvbNx46Ill6StHh6efcDTMWyzDMCDw"; // Use your CALLBACK KEY from profile

    const signature = req.headers.getFirstValue("X-SIGNATURE") orelse "";
    const timestamp_str = req.headers.getFirstValue("X-TIMESTAMP") orelse "0";
    const timestamp = try std.fmt.parseInt(i64, timestamp_str, 10);

    var body_reader = req.reader();
    const body_bytes = try body_reader.readAllAlloc(allocator, 1024 * 1024);
    defer allocator.free(body_bytes);

    const body_value = if (body_bytes.len > 0)
        try json.parseFromSlice(json.Value, allocator, body_bytes, .{})
    else
        json.Value{ .object = json.ObjectMap.init(allocator) };

    const query_string = req.head.target; // Simplified

    var data_map = json.ObjectMap.init(allocator);
    try data_map.put("params", json.Value{ .string = query_string });
    try data_map.put("body", body_value);

    const data = json.Value{ .object = data_map };

    const is_valid = try signer.Signer.verify(allocator, signature, callback_key, timestamp, data);

    std.debug.print("TIMESTAMP: {d}\n", .{timestamp});
    std.debug.print("SIGNATURE CANDIDATE: {s}\n", .{signature});
    std.debug.print("IS VALID SIGNATURE: {}\n", .{is_valid});

    if (is_valid) {
        try req.respond("{\"status\":\"ok\"}", .{
            .status = .ok,
            .extra_headers = &[_]http.Header{
                .{ .name = "Content-Type", .value = "application/json" },
            },
        });
    } else {
        try req.respond("{\"error\":\"Invalid signature\"}", .{
            .status = .unauthorized,
            .extra_headers = &[_]http.Header{
                .{ .name = "Content-Type", .value = "application/json" },
            },
        });
    }
}

pub fn main() !void {
    var gpa = std.heap.GeneralPurposeAllocator(.{}){};
    defer _ = gpa.deinit();
    const allocator = gpa.allocator();

    var server = http.Server.init(allocator, .{ .reuse_address = true });
    defer server.deinit();

    const address = try std.net.Address.parseIp("127.0.0.1", 8080);
    try server.listen(address);

    std.debug.print("Server listening on http://127.0.0.1:8080\n", .{});

    while (true) {
        var req = try server.accept(.{ .allocator = allocator });
        defer req.deinit();

        try handleCallback(allocator, &req);
    }
}