Generates a new webhook signing secret for the authenticated application, stores only its hash, and returns the raw secret once.
Use the returned webhookSecret to verify X-IDaaS-Signature on inbound webhooks.
The previous webhook secret becomes invalid immediately.
Obtain a token from POST /v1/auth/token using your client_id and client_secret, then enter Bearer <token> here.