Security
A token gives full access to the house: keep it like a password and use a separate user for integrations. Webhooks need no token, so make webhook_id long and random. From outside the API works only with remote access set up: remote access.
Smart home
Home Assistant API requests
Build a Home Assistant REST API request: get a state, call an action (turn on a light), render a template, fire an event or a webhook, as ready curl, Python and JavaScript with the token.
The token never leaves this page. Create one in your profile → Security → Long-lived access tokens.