Source IP allowlist

An input's source IP allowlist limits which addresses can send webhooks to it. When the list is not empty, a request whose source IP doesn't match any entry is rejected with 403 at the edge. It isn't stored, no function runs, and nothing is forwarded to your outputs or agents.

The allowlist is available on the Business, Pro and Enterprise plans.

Rules

• Each entry is an IPv4 or IPv6 address (203.0.113.10, 2001:db8::1) or a CIDR range (198.51.100.0/24, 2001:db8::/32).
• Up to 20 entries per input.
• A single address is stored as /32 (IPv4) or /128 (IPv6). Host bits in a range are cleared, and duplicates are removed.
• An empty list allows every sender. That's the default, so existing inputs are unchanged.

Set it in the dashboard

Open Buckets → your bucket → the input → Settings. In the Source IP allowlist card, enter one address or range per line and save. The card shows invalid lines inline and counts entries out of 20.

Set it through the API

Send ip_allowlist when you create or update an input:

curl -X PUT https://my.webhookrelay.com/v1/buckets/$BUCKET_ID/inputs/$INPUT_ID \
  -u "$RELAY_KEY:$RELAY_SECRET" \
  -H 'Content-Type: application/json' \
  -d '{"ip_allowlist": ["203.0.113.10", "198.51.100.0/24", "2001:db8::/32"]}'

On an update, leaving ip_allowlist out keeps the current list, and [] clears it. Reads always return the field, as [] when it's empty. The MCP server tools create_input, update_input and get_input accept and return the same field.

What a blocked sender sees

HTTP/1.1 403 Forbidden

source IP 192.0.2.44 is not allowed to send webhooks to this endpoint

The response never reveals the list. Rejected requests don't create webhook logs, so traffic from unknown addresses can't fill your logs or leave its payloads in your account.

Errors when saving

If an account moves below Business, its existing allowlists keep being enforced, so the protection doesn't silently disappear. Entries can still be removed or the list cleared, but new ones can't be added.

Notes

• Which IP is checked. The source address of the connection to Webhook Relay. X-Forwarded-For, X-Real-IP and similar headers are ignored, because any sender could forge them.
• Your own proxy or CDN. If you put a proxy or CDN in front of a custom domain, webhooks arrive from that proxy, so allowlist its IP ranges.
• Where to find provider ranges. Most providers publish the addresses they send webhooks from. For example, GitHub lists them under hooks in its meta API.
• Combine it with signatures. An allowlist stops traffic from unknown networks. A signature check proves the payload came from the provider and wasn't changed. Use both for webhooks that reach private networks.