Webhook API workflow getting triger without being ping

Webhook API workflow getting triger without any ping from server ? . and then its running unnecessary things,

Any one faced it

Do you have the necessary security practises in place so that no one calls your endpoint without any auth?

yes, test version no one else going to call my endpoint, it should only get triger when the server ping me like stripe or veriff. its a webhook.

but somehow no matter if i run a backend api workflow it triger my webhook