A followup on this thread is how I can create a low-access-level-key or similar with the sole access-rights to be able to send these webhooks to the specific room.
The security implications are a bit too wide using my own account as part of the authentication, whereas I would rather want a low-access-level credential to do this.
It would allow me to distribute that “app-key” without risking it being used to access other stuff in Nextcloud (since I would at present, distribute both username + api-key.)