You are correct.  The suggestion from the API documentation is to include a secret token as a custom parameter to the callback_url, which I can then check against for any incoming GETs.  That seems satisfactory to me, but do you have any other ways of handling this?