Tokens can be passed in as a parameter in the web request URL. The request here is to be able to hide certain parameters so that those who can view webhooks will not be able to see the tokens used.