diff --git a/app/Http/Middleware/ValidateSignatureFlexible.php b/app/Http/Middleware/ValidateSignatureFlexible.php
new file mode 100644
index 0000000..cbcda39
--- /dev/null
+++ b/app/Http/Middleware/ValidateSignatureFlexible.php
@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+
+class ValidateSignatureFlexible
+{
+    public function handle(Request $request, Closure $next)
+    {
+        $signature = $request->query('signature');
+
+        if (! $signature) {
+            abort(403);
+        }
+
+        // Pakai APP_URL, bukan request scheme
+        $baseUrl = rtrim(config('app.url'), '/') . '/' . ltrim($request->path(), '/');
+
+        $query = collect($request->query())
+            ->except('signature')
+            ->map(fn ($value, $key) => $key.'='.$value)
+            ->implode('&');
+
+        $original = rtrim($baseUrl.'?'.$query, '?');
+
+        $expected = hash_hmac('sha256', $original, config('app.key'));
+
+        if (! hash_equals($expected, $signature)) {
+            abort(403, 'Invalid signature.');
+        }
+
+        return $next($request);
+    }
+}
\ No newline at end of file
diff --git a/bootstrap/app.php b/bootstrap/app.php
index e5b02cd..7b013d3 100644
--- a/bootstrap/app.php
+++ b/bootstrap/app.php
@@ -12,6 +12,10 @@
         health: '/up',
     )
     ->withMiddleware(function (Middleware $middleware): void {
+        $middleware->alias([
+            'signed' => \App\Http\Middleware\ValidateSignatureFlexible::class,
+        ]);
+
         $middleware->trustProxies(
             at: '*',
             headers: Request::HEADER_X_FORWARDED_FOR |