Validate incoming API token and return access decision

Your webhooks sometimes arrive without validated tokens, causing unauthorized triggers and wasted engineering time. It enforces token checks so only authorized requests proceed before processing.