Hi everyone, when using external functions with webhooks, how can i be sure that is in fact Graphcool calling them and not someone else? I looked in the documentation and found nothing about this. I was thinking of using a custom header, but i'm not sure of the security implications.

Custom header is indeed a common way to do it.