Validating webhook deliveries - GitHub Docs

You can use a webhook secret to verify that a webhook delivery is from GitHub.
developer.github.com developer.github.com