How do I verify an alert webhook actually came from Tessary?

Check the signature. Every webhook delivery ships as a versioned, HMAC-signed envelope rather than a bare JSON blob, so you verify the request against the shared secret from your webhook channel before you trust anything in it. A request with no valid signature, or a payload that’s been altered after signing, didn’t come from Tessary, because the signature covers the whole envelope and breaks the moment a field changes.

That check is what turns a public webhook URL from something you unsafely act on into something you can actually decide with, since anyone who finds the URL can otherwise post a fake case at it. Delivery itself is best-effort with no retry queue behind it, so the way to confirm a case really fired, versus a request just never arriving, is to check the delivery log for that channel rather than assume silence either way.