I need to call and create a webhook inside a third party platform. The caller code and the return url of the webhook is inside Salesforce.

In Salesforce I need to implement a webservice for the return url. Basically, I don't think using Oauth2 login here is an option because the webhook return call won't be able to login here.

So probably I should use a site to build a public web service here? I don't see an issue with the security because the webservice will only expose minimum amount of data.

But the issue is we are building it in a managed package. I don't think we can include sites inside a package? Correct me if I am wrong.
Is there any walkaround for this?

Hi! When I click a button on the VF page, I need to send e-mail to 4 members and the e-mail body should be same for all the 4 members. What can I do ?