I've asked this question: https://security.stackexchange.com/questions/273569/why-are-hmac-signatures-frequently-used-for-webhook-authorization-but-not-other ht

I've asked this question: https://security.stackexchange.com/questions/273569/why-are-hmac-signatures-frequently-used-for-webhook-authorization-but-not-other https://security.stackexchange.com/questions/273569/why-are-... I never got a satisfactory answer, but I think the article is correct. Signed requests is hard for clients, and there are more API clients (consumers) than webhook clients (services).