# In your webhook handler
api_key = request.headers.get('X-API-Key')
environment = request.headers.get('X-Environment')

if api_key != EXPECTED_API_KEY:
    abort(401, 'Invalid API key')