GDPR Webhooks Authenticity

Issue summary

Hello everyone, I have created an app using Shopify CLI - PHP template. My app got rejected three times because of GDPR webhooks endpoints.

I have verifies the hmac using shopify documentation in web/app/Lib/Handlers/Gdpr directory and set the endpoints for it in partners shopify.

First Attempt Error:
App must verify the authenticity of the request from Shopify.
Expected HTTP 401 (Unauthorized), but got HTTP 405 from https://my-app-domain/webhooks/shop/redact. Your app's HTTPS webhooks endpoints must validate the HMAC digest of each request, and return an HTTP 401 (Unauthorized) response code when rejecting a request that has an invalid digest.

Again, I have created routes for them in web.php and implement the same hmac verification on controller and set the endpoints for them in partners Shopify but the error says:

Second Attempt Error
App must verify the authenticity of the request from Shopify.
Expected HTTP 401 (Unauthorized), but got HTTP 419 from https://my-app-domain/shop/redact. Your app's HTTPS webhook endpoints must validate the HMAC digest of each request, and return an HTTP 401 (Unauthorized) response code when rejecting a request that has an invalid digest.

Anyone who can guide me how to verify them and set the endpoints for them.

Start with web/app/Lib/Handlers/Gdpr and the routes in web.php, then trace the configured /webhooks/shop/redact and /shop/redact endpoints. Reproduce the reported 405 and 419 responses and compare their behavior with the stated invalid-request expectation. Done when the endpoint behavior is clearly documented or corrected and can be verified against the reported responses.