were gonna make this webhook shit WORK

.env.example

@@ -48,6 +48,18 @@ BRICKSET_API_KEY=your_brickset_api_key
 # Generate with: python convert_to_p7b.py
 SQUARE_P7B_PATH=./cert.p7b
 
+# ============================================================================
+# Square Webhook Signature Verification
+# ============================================================================
+
+# CRITICAL: Get these from Square Developer Dashboard → Webhooks
+# Signature key used to verify webhook authenticity (prevents spoofing)
+SQUARE_WEBHOOK_SIGNATURE_KEY=your_webhook_signature_key_from_square
+
+# Your webhook notification URL (must match exactly what's in Square Dashboard)
+# Example: https://studspider.sh/hook
+SQUARE_WEBHOOK_URL=https://yourdomain.com/hook
+
 # ============================================================================
 # Server Configuration (Optional)
 # ============================================================================