A secret value of your choice (up to 50 characters). Mamo sends it unchanged as the Authorization header on every webhook delivery to this URL. Check it in your handler and reject requests that don't match, so only Mamo can trigger your webhook. Example: set it to Bearer <random-secret> and compare the incoming Authorization header against it.