Webhooks helps you to trigger some actions on your server when an event happens with you repositories.

HMAC SHA512 key: it is a string that will be used to sign the payload; this way you can be sure that the server knows the secret and you can go on to process the request. You can use any character you want: letters, digits and any symbol.
The server will create a HMAC over the payload using SHA512 and will add a HTTP header: X-RocketGit-Signature: <signature>. It is recommended to verify it before parsing the body, for security reasons. It is not generated for application/x-www-form-urlencoded encoding.