To validate that callback is sent by SiQURO you should generate hash and compare to the callbacks X-SIQ-SIGNATURE header.

SiQURO signature is a hex-encoded SHA-256 hash where key is a merchant secret and payload is concatenated from callbacks timestamp header and raw body with .

The naive implementation in PHP could be

$token_api_secret = 'API key secret'

$signed_payload = $request_headers['X-SIQ-TIMESTAMP'] . '.' . $raw_request_body;
$expected_signature = hash_hmac('sha256', $signed_payload, $token_api_secret);

if (hash_equals($request_headers['X-SIQ-SIGNATURE'], $expected_signature)) {
    // callback is sent by SiQURO
} else {
   // Unknown callback. Reject it!
}

NOTE! Please validate also amount and currency of the transaction in your database and that is received in the callback. They can`t change while processing otherwise such callbacks should be rejected.