Ghost's Admin API doesn't seem to publish a list endpoint for webhooks (GET /admin/webhooks/ returned 406 in production), which is why the lib special-cases webhooks to only expose add/edit/delete. Pivot the idempotency logic: try to add() each of the four required webhooks; if Ghost rejects with the validation error it returns for duplicates ("…already been used for this event"), treat that as "already installed." Any other error is a real failure. Drop the JWT helper + listWebhooks + createHmac import — no longer needed once the lib does all the auth for the only call we still make.