docs(webhooks): clarify webhook signature validation (#17)

Author: stainless-bot

README.md

@@ -276,7 +276,11 @@ while (page != null) {
 
 We provide helper methods for verifying that a webhook request came from Lithic, and not a malicious third party.
 
-You can use `lithic.webhooks().verifySignature(body, headers, secret?)` or `lithic.webhooks().unwrap(body, headers, secret?)`.
+You can use `lithic.webhooks().verifySignature(body, headers, secret?)` or `lithic.webhooks().unwrap(body, headers, secret?)`,
+both of which will raise an error if the signature is invalid.
+
+Note that the "body" parameter must be the raw JSON string sent from the server (do not parse it first).
+The `.unwrap()` method can parse this JSON for you.
 
 ---