I'm pretty sure if you google around you'll find a site that takes your credentials and sets up both Thingspeak and the Particle Webhook for you like magic, not that such an approach helps you understand how it all goes together.
A multi value publish string might look like this:
Particle.publish( "thingSpeakWrite_ALL", "{ \"1\": \"" + String(S1) + "\","+
"\"2\": \"" + String(S2) + "\"," +
"\"3\": \"" + String(S3) + "\"," +
"\"4\": \"" + String(A) + "\"," +
"\"5\": \"" + String(B) + "\"," +
"\"6\": \"" + String(SWiFi) + "\"," +
"\"7\": \"" + Version + "\"," +
"\"k\": \"MyLovelySecretKey\" }", 60, PRIVATE);
and the webhook mustache mularkey like this
{
"api_key": "{{k}}",
"field1": "{{1}}",
"field2": "{{2}}",
"field3": "{{3}}",
"field4": "{{4}}",
"field5": "{{5}}",
"field6": "{{6}}",
"field7": "{{7}}",
"field8": "{{8}}",
"lat": "{{a}}",
"long": "{{o}}",
"elevation": "{{e}}",
"status": "{{s}}"
}
You can also include the key in the URL instead of publishing it as a parameter, and this webhook was generated by the magic page I mentioned, which is possibly why it includes fields I then ignore.
Edit:
Formatting is key here, get a bit of that string wrong and nothing will work. You can use a site such as https://requestb.in/ to test your JSON/mustache to check what exactly your publish is being translated to by Particles magic.