Removing username and api_key from webhook payload I got scared for security