Used in URLs: /api/my-app/dynamic/*
Used to verify incoming webhook requests (HMAC-SHA256 of request body)