When I say “make”, I mean in your own api client library. It should happen automatically so the user doesn’t have to think about it.

You can provide some functions for the webhooks so targeted to authenticate and decrypt the stuff posted to them.