Webhooks now come from a fixed set of source IPs
Webhook deliveries now come from a small, fixed set of static IP addresses
instead of a changing range, so they can be allowlisted on a firewall or
ingress. Each delivery also carries a new x-client-id header holding your
client app id.
What changed
- Webhook traffic previously originated from a range of dynamic addresses. It now comes from a fixed set of addresses that are not expected to change.
- Every webhook now includes an
x-client-idheader containing your client app id, so a receiver handling more than one app can tell them apart without parsing the body.
Action required
Only if you restrict inbound traffic by source IP. Contact us for the current address list and add it to your allowlist — we do not publish the addresses here. We will give advance notice before they ever change.
If you do not filter by source IP, nothing changes for you.