You must authenticate to the Webhooks API using the HTTP Basic Auth mechanism. The HTTP header should follow this structure:
Authorization: Basic base64_encode(<user api token>:api_token)
<user api token>is your personal API token that you can find in your Toggl Track profile.
base64_encodeis the encoding in Base64 of the string composed by your API token and followed by ":api_token".
Whenever possible, please use the tools and interfaces provided by your http library to do Basic Auth, for example: curl uses the -u switch to allow for it.