We only allow access to a POST request with the correct username and API key combination so as long as you haven’t exposed your API key, your request is secure else you can always regenerate the API key from your dashboard.
If you are using a SIP trunk, you can whitelist our IP address to ensure that the traffic you are getting is from us.