Security best practices

Always verify on the server. The widget's callback proves nothing by itself.
Check the hostname against your own, so a token from another site can't be replayed against yours.
Set an action per form and check it, so a newsletter token can't sign someone up.
Verify once, then act. Tokens are single-use; don't verify in a pre-flight request and again on submit.
Keep the secret on the server, and rotate it if it ever leaks.
Decide what an outage means for each form: fail closed for sign-ups and payments, consider failing open for log in.