docs: VERIFY_TOKEN is written by sandbox env too (AIT-179)

[ord669]

Summary

• Docs-only: README, AGENTS.md, and .env.example now describe VERIFY_TOKEN as written by both hookmyapp sandbox env and hookmyapp channels env, used by the webhook set GET handshake, and distinct from WEBHOOK_HMAC_SECRET.
• No kit code changes — the GET handler already echoed VERIFY_TOKEN.

Rollout

Merge after hookmyapp CLI release that writes VERIFY_TOKEN (hookmyapp/cli AIT-179 PR).

Test plan

• Docs-only; no runtime change

Summary by CodeRabbit

• Documentation
  • Updated .env.example to include an active VERIFY_TOKEN used for webhook verification.
  • Revised sandbox and environment guidance to state VERIFY_TOKEN is now written by both sandbox and channel env setup flows.
  • Expanded webhook verification instructions to include the sandbox webhook setup command, clarifying that the kit performs the one-time GET verification automatically.
• Changelog
  • Added an Unreleased entry noting the corrected sandbox verify-token documentation/behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 0c85bcd2-c15c-46b2-b7ef-5d1c8088f95b

📥 Commits

Reviewing files that changed from the base of the PR and between d6a8adf and 43d9ceb.

📒 Files selected for processing (1)

• .env.example

🚧 Files skipped from review as they are similar to previous changes (1)

• .env.example

---

📝 Walkthrough

Walkthrough

The PR updates the environment template and documentation to state that sandbox tooling writes VERIFY_TOKEN and that sandbox and channel webhook setup commands perform the verification GET handshake.

Changes

Sandbox verification documentation

Layer / File(s)	Summary
Environment token contract .env.example, AGENTS.md, README.md	VERIFY_TOKEN is active in the environment template, and setup documentation states that sandbox and channel environment commands write it.
Webhook verification guidance README.md, CHANGELOG.md	Documentation lists sandbox webhook setup alongside channel setup and records that the verification GET uses VERIFY_TOKEN.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• hookmyapp/webhook-starter-kit#2: Updates related VERIFY_TOKEN and webhook verification documentation.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely captures the main docs change: VERIFY_TOKEN is now written by sandbox env too.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ait-179-sandbox-verify-token

⚔️ Resolve merge conflicts

• Resolve merge conflict in branch ait-179-sandbox-verify-token

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

CHANGELOG.md (1)

3-8: 🎯 Functional Correctness | 🔵 Trivial

Gate this documentation on the corresponding CLI release.

This entry promises that sandbox tooling writes VERIFY_TOKEN and performs the verification GET. Merge or publish it only after the CLI/backend AIT-179 release, or document the minimum required CLI version.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@CHANGELOG.md` around lines 3 - 8, Update the Unreleased changelog entry to
specify the minimum CLI/backend AIT-179 release required for the VERIFY_TOKEN
writing and verification-GET behavior, or defer the entry until that release is
available.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.env.example:
- Around line 11-13: Update the comment above VERIFY_TOKEN to identify it as the
webhook verification/handshake token rather than a webhook URL, while preserving
the existing command references and clarifying that VERIFY_TOKEN should contain
the handshake response token.

---

Nitpick comments:
In `@CHANGELOG.md`:
- Around line 3-8: Update the Unreleased changelog entry to specify the minimum
CLI/backend AIT-179 release required for the VERIFY_TOKEN writing and
verification-GET behavior, or defer the entry until that release is available.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 108c7bdf-6bab-4658-a8a4-643115a12881

📥 Commits

Reviewing files that changed from the base of the PR and between 7da1d0e and d6a8adf.

📒 Files selected for processing (4)

• .env.example
• AGENTS.md
• CHANGELOG.md
• README.md