How to receive webhooks from 3rd party

How can I receive a webhook from an external service and, assuming they have been validated, use their payload to interact with the admin API?

I have set up a new route that doesn't use the /api path and have that working, but I'm not sure how to then forward a request on to an authenticated /api route from within the Express back end.

I tried using http-proxy-middleware and also tried creating a custom app session:

    const session = await shopify.api.session.customAppSession(
      'external-service-test.myshopify.com'
    );
    data = await shopify.api.rest.Product.count({
      session,
    });

With the later, I get "error": "Missing access token when creating REST client".

Any help appreciated!

As an aside, I've spent a good amount of time scouring the docs to try and figure this out, but find the documentation for interacting with the API really confusing to follow and spread out across so many different repos and doc pages that don't provide quite enough info to easily get the whole picture. For example: https://github.com/Shopify/shopify-api-js/blob/main/docs/guides/session-storage.md#load-a-session-from-storage: in the code block there it says // getSessionFromStorage() must be provided by application but there are no examples of what that does or how to set it up.

Start with the webhook route, the attempted customAppSession code, and the linked session-storage guide. Determine which supported flow should be documented for validating an external webhook and calling the authenticated Admin API, then make the relevant setup and storage examples complete and verifiable.