In this video I show you a simple but very effective safeguard for your Make.com scenarios: securing a Custom Webhook so it can’t be triggered by just anyone who gets hold of the URL. The core idea is API key authentication via an HTTP header — I pass the key in the X-Make-API-Key header and validate it before the “real” automation is allowed to run. If the key is missing or wrong, the request is rejected with a clean 401 Unauthorized. That alone already cuts down unwanted external accesses massively. I also explain why “just calling the webhook link” is the problem in the first place and why header-based protection is the right approach for paid automations or anything business-critical. Then I walk through my two-step setup: a main webhook that receives the request and a secured scenario/step that only continues when the API key check passes. In the demo you see both cases — a successful call with the correct header and a failed call that gets blocked. My takeaway: secure your scenarios now, because webhooks are powerful, but without access control they’re an open door.