Fix PCM auth: login for API token and multi webhook secrets.

PCM DirectMail v3 needs POST /auth/login (apiKey+apiSecret) before design/order calls; accept each subscription's copy-only signature secret via PCM_WEBHOOK_SECRETS.

site/messaging/README.md

@@ -51,11 +51,18 @@ Default postcard provider. Designer embeds PCM’s editor; orders use DirectMail
 
 | Var | Purpose |
 |-----|---------|
-| `PCM_API_KEY` | Bearer token for `https://v3.pcmintegrations.com` |
-| `PCM_WEBHOOK_SECRET` | Auth for inbound status webhooks |
+| `PCM_API_KEY` | API key from PCM portal (My Account → API Keys) |
+| `PCM_API_SECRET` | Matching API secret; used with key on `POST /auth/login` |
+| `PCM_CHILD_REF_NBR` | Optional child-app ref for multi-account |
+| `PCM_WEBHOOK_SECRETS` | Comma-separated signature secrets (one per PCM subscription) |
+| `PCM_WEBHOOK_SECRET` | Optional single-secret alias (merged into the list above) |
 | `PCM_RETURN_ADDRESS` | JSON return address on orders |
 | `POSTCARD_PROVIDER` | `pcm` (default) |
 
+Auth flow: `POST /auth/login` with `{apiKey, apiSecret}` → short-lived
+`token` used as `Authorization: Bearer …` on design/order calls
+([PCM Logging In](https://docs.pcmintegrations.com/docs/directmail-api/ffef03a112bb0-logging-in)).
+
 ### Designer
 
 Portal → **Postcard design**: create/list designs via API, edit in iframe
@@ -64,16 +71,19 @@ Portal → **Postcard design**: create/list designs via API, edit in iframe
 
 ### Postcard webhook
 
-Create a webhook subscription in the PCM dashboard (Working with Webhooks):
+PCM allows **one event per subscription**, and each subscription gets its own
+**signature secret** (copy-only in the UI). Create one subscription per status
+you care about; point them all at the same URL and paste every secret into env.
 
 | Field | Value |
 |-------|--------|
 | URL | `https://mkdrealtor.com/portal/messaging/webhooks/postcard/` |
-| Authorization | **Bearer** + `PCM_WEBHOOK_SECRET` |
-| Events | Order / recipient status (Pending, Processing, Processed, Delivered, Undeliverable, Canceled) |
+| Events | One subscription each: Pending, Processing, Processed, Delivered, Undeliverable, Canceled (skip QrCodeScan unless needed) |
 | Environments | Sandbox and/or Production as needed |
+| Secrets | Copy each subscription signature → `PCM_WEBHOOK_SECRETS=sec1,sec2,…` |
 
-Fallback: `?token=<PCM_WEBHOOK_SECRET>` on the URL.
+We accept Bearer, `?token=`, or common signature headers (raw secret or
+HMAC-SHA256 of body) matching **any** listed secret.
 
 Correlation: we send `extRefNbr=<Message.uuid>` on each recipient; webhooks should
 echo that (or `orderID`, matched to `Message.provider_message_id`).
@@ -99,7 +109,8 @@ EMAIL_HOST_PASSWORD=…
 SMTP2GO_WEBHOOK_SECRET=…
 SMTP2GO_SMS_API_KEY=…   # SMS sends only
 PCM_API_KEY=…
-PCM_WEBHOOK_SECRET=…
+PCM_API_SECRET=…
+PCM_WEBHOOK_SECRETS=sec1,sec2,…
 PCM_RETURN_ADDRESS={…}
 ```