Before you start wiring up webhooks, let's lock them down. Webhooks are disabled by default. To enable them, set hooks.enabled: true in your OpenClaw config. You must also set hooks.token to a secret string that callers include in their requests.
Callers authenticate by passing the token as a Bearer token in the Authorization header: Authorization: Bearer YOUR_TOKEN. For services that can't set custom headers, you can pass the token as a query parameter: /hooks/wake?token=YOUR_TOKEN. Without a valid token, OpenClaw returns a 401 response and logs the rejected attempt.