Now you tell Woosa that your shop exists.
This is the one and only request that should not be signed. You have no secret key yet, so there is nothing to sign with.
Body:
"url": "https://myshop.example.com/",
"key": "ck_781d7a45573443cba7e263901c0c5da511e98949d1",
"secret": "cs_029425b4341cce8caa5de3bdd339a1c330f23d55",
What happens behind the scenes (this is the "handshake"):
Woosa receives your registration.
Woosa calls your GET settings endpoint from Part 1a, using the key and secret you just sent, to confirm they work.
If that succeeds, Woosa generates your woosa_secret and pushes it to your POST batch endpoint from Part 1b.
Your shop stores the secret.
A successful registration returns 204 No Content (an empty success). If you get a 401, it usually means Woosa could not authenticate against your callback endpoints, so double-check Part 1. If you get a 400, something in the body is wrong.
After this step you hold a woosa_secret. Everything from here on is signed with it.