An HMAC signature is a keyed hash (HMAC-SHA256) of a webhook's timestamp and body, computed with a secret shared with your endpoint, so you can verify that the event came from the gateway and was not altered.
Anyone can send an HTTP request to your webhook URL. The signature is what makes an event trustworthy: the gateway computes HMAC-SHA256 over the timestamp, a separator and the exact raw body with the endpoint's secret; you recompute it and compare in constant time. Including the timestamp and rejecting old ones defeats replay of a captured request.
The classic mistake is verifying a re-serialised body: parse after verifying, never before.
At SMSMeteor: the header X-Meteor-Signature carries t=timestamp,v1=signature over timestamp.body; verification code in Node, Python and PHP is on the webhooks page.