I would like to get the comment, attachment and status information from the clickup ticket in a secured way (e.g. Oauth 2.0)

1) If I use automation to call webhook, i can update header to include the basic authentication key. However, clickup always pass the "Automation Call webhook payload" which does not contain comment/ attachment

2) if I create a webhook and subscribe to different events, I can only use the Webhook signature (i.e. HMAC authentication)

can i have another alternative to achieve the goal?