make configuring the hmac secret optional if no webhook is involved