Webhook source IPs

Webhook deliveries currently leave from a single public address:

37.60.231.72

Verify the signature. The address is a convenience.

HMAC verification is the control that actually protects you. An IP address can be spoofed; a signature computed with your endpoint secret cannot. Every delivery carries X-CowriePay-Timestamp and X-CowriePay-Signature, and verifying them is not optional.

This page exists for one reason: integrators behind a corporate firewall often need an address to let the traffic through at all. That is a network-admission question, not an authentication one.

Do not replace signature verification with an IP filter. They are not equivalent, and an IP allowlist alone would accept a forged request from anyone who could route from that address.

The list can change

One address today does not mean one address forever. A second node, a different host, or a change of provider would add or move an entry, and an integration that hard-codes this value will break the day that happens.

If you do allowlist it:

• treat the value as configuration, not as a constant in your code;
• keep signature verification on regardless, so a change of address degrades to a firewall ticket rather than to unverified traffic being accepted;
• watch for a notice: changes to this list are announced ahead of time to workspaces with active webhook endpoints.