Unless you create the orders yourself via API (and add the metafields then), I see no opportunity to have the metafields added between the order creation and order/create webhook triggering.
For future users - yes, you can add metadata to an existing order that was created through the normal order flow and not the API. You’d be forgiven for thinking you couldn’t as the docs only mention Product meta and Shop meta.
This Stackoverflow answer pointed me in the right direction. My example is in PHP but you get the idea. Works perfectly;
It’s probably worth clarifying the statement about not using the url with the API key in it.
Don’t expose API keys on the frontend peeps. So you wouldn’t use these urls in Javascript.
If (as in the example above written in PHP), you are using it in a method on a server side script … then there is no problem using urls with API keys in them. That’s what they were designed for.