APIs & Integrations

js-envisa
Member

IP address block for workflow webhooks

Does anyone know the IP address block that webhooks from workflows originate from? We would like to lock down access to our endpoint to only the addresses that would need to access it.

Thanks.

0 Upvotes
5 Replies 5
johnwfoster
Member

IP address block for workflow webhooks

It is very suprising that there is no domain or IP list/range that webhooks would originate from.  From our perspective, this is a huge security concern.  While I appreciate that there are ways to authenticate the request, it makes no sense to have to open up any internal systems to the entire web.  Please fix this security issue ASAP.

Siddall
Top Contributor

IP address block for workflow webhooks

Bueller...Bueller...Bueller... :rofl:

0 Upvotes
Siddall
Top Contributor

IP address block for workflow webhooks

@js-envisa - Did you ever get a resolution to this?

We also need to do a workflow webhook but don't want to open up the webservice to the www (wild wild west :slight_smile: )

@dadams - Is a list of IPs still unavailable? Would you be able to answer the OP's question of:

So we can’t limit connections to our endpoint to only be for requests coming from HubSpot?

Would the requests be originating from hubspot.com or even app.hubspot.com?

Thanks folks!
Siddall

0 Upvotes
js-envisa
Member

IP address block for workflow webhooks

So we can’t limit connections to our endpoint to only be for requests coming from HubSpot?

Would the requests be originating from hubspot.com or even app.hubspot.com? I am looking for some way to limit connections to a specific set of IPs so that our endpoint isn’t open to the entire world to hammer on. Sure I could put HTTP authentication on it but it would still be open to the world.

0 Upvotes
Dadams
HubSpot Employee
HubSpot Employee

IP address block for workflow webhooks

Hi @js-envisa

We don’t have a list of IPs that would be used for HubSpot services, and any IPs that are currently used today are subject to change at any point.

We do support simple HTTP authentication for webhooks, which you can enable when setting up the webhook in the workflow.

How do I use webhooks with HubSpot workflows?

Learn how you can use the trigger a webhook action in HubSpot workflows.

0 Upvotes