Webhook Relay
Plans: Business, Pro and Enterprise

Product feature

Source IP Allowlist for Webhook Endpoints

Accept webhooks only from the IP addresses and CIDR ranges you list. Everything else gets a 403 at the edge, before it is stored, run or forwarded into your network.

Lock each webhook endpoint to the networks that are supposed to call it. Add your providers' published IP addresses and CIDR ranges to an input's source IP allowlist. Requests from anywhere else get a 403 at Webhook Relay's edge, and they're never stored, run through a function or forwarded to your servers.

How it works

  1. Add up to 20 IPv4 or IPv6 addresses or CIDR ranges to an input, in the dashboard or with the ip_allowlist API field.
  2. Webhook Relay compares the source address of each connection against the list. Forwarding headers such as X-Forwarded-For are ignored, because a sender could forge them.
  3. Matching requests continue as usual: signature checks, functions, retries and delivery.
  4. Everything else gets 403 Forbidden. The response doesn't reveal the list, and nothing is written to your logs.

Why it matters

  • Security reviews ask for it. "Can you restrict the endpoint to the vendor's IP ranges?" is a standard questionnaire item, and now the answer is yes.
  • Less exposure for private networks. When webhooks are delivered through an outbound-only agent or the Kubernetes operator, the allowlist means only your providers' networks can reach that path at all.
  • No noise from scanners. Blocked requests don't create logs, so random internet traffic can't fill your account or bury real deliveries.
  • Safe through plan changes. If an account moves below Business, existing lists keep being enforced, so the protection doesn't silently disappear.

Pair it with signature verification

An allowlist answers "which network sent this?" A signature check answers "did the provider sign this exact payload?" Many providers send from shared cloud ranges, so for anything that reaches a private network, use both.

Setup steps, API examples and error codes are in the IP allowlist docs. Preparing a vendor review? See the security review kit.

Frequently asked questions

Can I restrict which IP addresses can send webhooks to my Webhook Relay endpoint?

Yes. Each input has a source IP allowlist of up to 20 IPv4 or IPv6 addresses or CIDR ranges. When the list isn't empty, requests from any other address are rejected with 403 before anything is stored, run or forwarded. It is available on the Business, Pro and Enterprise plans.

Can a sender bypass the allowlist with an X-Forwarded-For header?

No. Webhook Relay checks the source address of the connection itself and ignores X-Forwarded-For, X-Real-IP and similar headers, which any client could forge.

Do rejected requests show up in my webhook logs?

No. Rejected requests aren't stored, so traffic from unknown networks can't fill your logs or leave its payloads in your account.

Should I use an allowlist or signature verification?

Both, for anything that reaches a private network. The allowlist stops traffic from networks you don't expect. A signature check proves the payload came from the provider and wasn't modified, even when the provider sends from shared cloud ranges.

Start forwarding webhooks in minutes

Connect a source, pick a destination, and Webhook Relay handles delivery, retries and transforms. Set up your first webhook in under five minutes.

Start for free ->

Free plan · No credit card required · 7-day money-back guarantee on paid plans