[immibis]

But the server has no problem storing a unique webhook address for each client.

I suppose you can just add a bearer token into the address, if you need that. A different address per association, containing a bearer token, with HTTPS, provides the same security as if the bearer token was sent in a separate header.