You need to check origin and authenticity of a webhook, whereas your API key is there to verify that you are the right person. In an API call, origin is already checked by HTTPS.