Configure the webhook URL and event subscriptions. Provide url and events to set it up; send an empty body (omit url) to remove the webhook entirely. When url is provided, events is required. A new HMAC secret is generated and returned once on first configuration — store it immediately. Webhook callbacks are signed: header X-Clint-Signature = "sha256=" + HMAC-SHA256 over "." using the returned secret.