How do I validate that a call to the "installed" lifecycle URL actually comes from Jira?

[menhirent]

I have a private application (which connects to a separate service that I provide) that's published using an app descriptor that the app provides. In this app descriptor, I am providing a lifecycle for installed:

"lifecycle":{"installed":"jira/was-installed"}

However, now I wonder how I would validate that someone that's calling the above URL on my application is actually coming from Jira, and not just someone trying to send a request to let me use their sharedSecret.

I noticed that sometimes, Atlassian sends an Authorization JWT header, and sometimes it doesn't when installing the app from the marketplace. But even if I had a JWT, anyone could create that one.

Is there a way to know what the clientKey should be? It's supposed to be the "Identifying key for the Atlassian product tenant that the app was installed into.", but how would someone installing the app know what that clientKey should be? (To whitelist it in the app)