There's another really cool way that I've started using lately - doPost[0]. You can set up a js (appscript) function with that name and then publish it for anonymous use (such that the long endpoint url is the secret key).

You can for example set up a cron job to post some json to that endpoint and have the js validate it and update a sheet accordingly (or even create a new one).

[0] https://developers.google.com/apps-script/guides/web