It may make sense for incoming webhooks to contain a user-configurable secret.  See https://github.com/cantino/huginn/blob/master/app/controllers/webhooks_controller.rb