I can’t exactly tell from the info provided, and also I don’t know PHP so can’t comment on whether the exact construction of everything is correct - it looks like this is the confirmation handshake processing, though, and that it’s returning the X-Hook-Secret like it’s supposed to.
There is this issue, I wonder if this is a clue:
Per that post, it looks like @Wesley_Andrade_Soare is setting HTTP 1.1 but I don’t know if there are other aspects that are required as well?
Also cc’ing @Ross_Grambo (when he’s back from holiday), he’s the current reigning Webhook champion expert!