Locating the Webhook Security Token

Use the API signature associated with the webhook client as the HMAC key. Keep it in your server-side secret store and never expose it in browser code, logs, or source control.