There isn't a standard way of authenticating the incoming notification yet. I like how Mailgun is doing it, to verify the webhook is originating from Mailgun you need to:

  * Concatenate timestamp and token values.
  * Encode the resulting string with the HMAC algorithm (using your API Key as a key and SHA256 digest mode).
  * Compare the resulting hexdigest to the signature.
  * Optionally, you can check if the timestamp is not too far from the current time.

So, you essentially get 3 extra parameters from your webhook, `timestamp`, `token` and `signature`. Obviously, the API key is the shared secret here between your app and Mailgun.