fix webhook code we hope

.env.example

@@ -30,34 +30,33 @@ BRICKSET_API_KEY=your_brickset_api_key
 # SSL Certificate Configuration (Optional)
 # ============================================================================
 
-# NOTE: Only needed if running HTTPS directly (not recommended with nginx)
-# For nginx reverse proxy setup, leave these empty
+# NOTE: Only needed if running HTTPS directly in Python (not recommended)
+# For production, use nginx reverse proxy with Let's Encrypt instead
+# nginx handles SSL/TLS, your Python app runs HTTP internally
 
-# Path to SSL certificate in PEM format
+# Path to SSL certificate in PEM format (if running HTTPS directly)
 # SSL_CERT_PATH=/path/to/cert.pem
 
-# Path to SSL private key in PEM format
+# Path to SSL private key in PEM format (if running HTTPS directly)
 # SSL_KEY_PATH=/path/to/key.pem
 
-# ============================================================================
-# Square Webhook Certificate (P7B Format)
-# ============================================================================
-
-# Path to P7B certificate file for Square webhook signature verification
-# This file is UPLOADED to Square Dashboard, not used by your server
-# Generate with: python convert_to_p7b.py
-SQUARE_P7B_PATH=./cert.p7b
-
 # ============================================================================
 # Square Webhook Signature Verification
 # ============================================================================
 
 # CRITICAL: Get these from Square Developer Dashboard → Webhooks
-# Signature key used to verify webhook authenticity (prevents spoofing)
+# 1. Go to https://developer.squareup.com/apps
+# 2. Select your application
+# 3. Click "Webhooks" section
+# 4. Create webhook subscription (Notification URL + Events)
+# 5. Copy the Signature Key that Square displays
+
+# Signature key from Square Dashboard (a string like "asdf1234")
 SQUARE_WEBHOOK_SIGNATURE_KEY=your_webhook_signature_key_from_square
 
-# Your webhook notification URL (must match exactly what's in Square Dashboard)
-# Example: https://studspider.sh/hook
+# Your webhook notification URL (must match EXACTLY what's in Square Dashboard)
+# This should be your public HTTPS URL (through nginx)
+# Example: https://yourdomain.com/hook
 SQUARE_WEBHOOK_URL=https://yourdomain.com/hook
 
 # ============================================================================