My bad on this one.
Silly mistake. I was using ngrok to tunnel the webhook to my local machine and request.protocol is returning ‘http’, but the tunnel is using ‘https’.
Everything works when I explicitly set the webhook URL to the full URL that I set when defining the webhook.
Note: this is the full URL, NOT the path, i.e. https://youdomain.com/rapyd-webhook-endpoint