How to verify if the Webhook call came from Swell?

[jramoyo-serenade]

How can we verify if a Webhook call came from Swell?

We were hoping we can use the "Alias" to set a shared secret -- but it does not seem to get sent back with the Webhook call.

Headers:

[logeshswell]

Currently, we don't have any security mechanism to verify the webhook data whether it is triggered from Swell.
Instead, we recommend fetching the associated record using data.id before performing a relevant action for the time being.
https://developers.swell.is/backend-api/webhooks/receiving-webhooks

[jramoyo-serenade]

Thanks for the response, do you have plans to implement this in the near future?

This approach is counter-intuitive and wouldn't this impact API limits?

[ericingram]

We typically recommend putting a shared secret in the webhook URL itself

[logeshswell]

@jramoyo-serenade You can also verify it using the list of IP addresses from which we will trigger webhooks:

52.52.111.237
54.219.85.17
54.241.235.166

Would this work for you?

[ruan-ikhokha]

@logeshswell How often would these change? And where/how can we check for changes?

[logeshswell]

IPs are very less likely to be changed. But, we don't have any medium to get to know if it's changed.

[logeshswell]

We can update the IP list in the below page if it's changed.
https://developers.swell.is/backend-api/webhooks/receiving-webhooks