Protect Webhooks

Use HTTPS for production targets. The receiver should validate the Bearer Token before processing the payload and use Delivery ID or Request ID as an idempotency key. For complete configuration, delivery semantics, logging, and failure handling, see Webhooks.