After an email with a member on the Photon team, it turns out I was using the wrong key. In order for BC to obtain the secret with it's specific name, I should have been using using WebHookCustomHttpHeaders where instead I was using WebHookSecret which forced the name to X-Secret - this change allowed me to include the BC secret in the header rather than URL (which was working but obviously in the header is preferred)
No errors on Quantum's side (they have no logs forwarded in dashboard) left me thinking it was on BC, when in fact all was working on their end.
Thanks again !