Webhooks are account-wide, not scoped to a study.
create_webhook returns an HMAC signing secret once. Store it securely and never repeat it in logs or ordinary chat output.
Creating a webhook changes an external integration and should require user confirmation. If a temporary webhook is created for testing, delete it before finishing.