# API IP Addresses / Firewall Whitelisting

**URL:** <https://community.hubspot.com/t/api-ip-addresses-firewall-whitelisting/11277>\
**Category:** APIs & Integrations\
**Tags:** contacts\
**Created:** [January 12, 2018, 7:22pm UTC](https://community.hubspot.com/t/api-ip-addresses-firewall-whitelisting/11277 "2018-01-12T19:22:08Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![system](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/system/32/124_2.png) [@system](https://community.hubspot.com/u/system)\
**Post date:** [January 12, 2018, 7:22pm UTC](https://community.hubspot.com/t/api-ip-addresses-firewall-whitelisting/11277/1 "2018-01-12T19:22:08Z")

</div>

Hi,

We have a custom CRM extension for our contacts that will allow us to show some data from our local CRM in the hubspot contact as detailed on: [Accounts Dashboard | HubSpot](https://developers.hubspot.com/docs/methods/crm-extensions/crm-extensions-overview)

To do this I have created a small webservice that we will host on one of our servers that provides hubspot with the UI json, and an endpoint to call when the action buttons are clicked. This works fine.

We want to be able to restrict access to this webservice so that only requests coming directly from hubspot are accepted. We cant seem to find a proper list of the IPs used by the APIs though? The support guys advised us to restrict by domain, however looking at the requests they all come from aws domains so that wont work

What should we do?/What other things have people done to get around this issue?

Thanks  
Matt

---

<div class="post-metadata">

**Author:** ![Derek\_Gervais](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/derek_gervais/32/17429_2.png) [@Derek\_Gervais](https://community.hubspot.com/u/Derek_Gervais)\
**Post date:** [January 17, 2018, 10:20pm UTC](https://community.hubspot.com/t/api-ip-addresses-firewall-whitelisting/11277/2 "2018-01-17T22:20:21Z")

</div>

Hi [@MattHodge](https://community.hubspot.com/u/matthodge),

We don’t document the IPs we use, since we don’t have a static IP range. To ensure that the requests you’re getting at your data fetch URIs and action hook URIs are actually coming from HubSpot, we populate a X-HubSpot-Signature header with a SHA-256 hash of the concatenation of the app-secret for your application and the request body we’re sending.

---

<div class="post-metadata">

**Author:** ![Siddall](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/siddall/32/98942_2.png) [@Siddall](https://community.hubspot.com/u/Siddall)\
**Post date:** [September 18, 2018, 9:24pm UTC](https://community.hubspot.com/t/api-ip-addresses-firewall-whitelisting/11277/3 "2018-09-18T21:24:25Z")

</div>

[@Derek\_Gervais](https://community.hubspot.com/u/derek_gervais) - How do we handle this when doing a POST using a Workflow Webhook step to a webservice on one of our servers? Thanks in advance!

---

<div class="post-metadata">

**Author:** ![Derek\_Gervais](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/derek_gervais/32/17429_2.png) [@Derek\_Gervais](https://community.hubspot.com/u/Derek_Gervais)\
**Post date:** [October 2, 2018, 8:54pm UTC](https://community.hubspot.com/t/api-ip-addresses-firewall-whitelisting/11277/4 "2018-10-02T20:54:33Z")

</div>

Hi @Siddall,

The workflow webhook action is different; since it’s not associated with an app, it doesn’t have the same X-HubSpot-Signature header. Instead, you should select the “Use authentication” option in-app, and input a username/password combination. This populates the Authorization header with Basic auth (i.e. a base64 encoding of the following concatenation: `username:password`). This can be used to confirm the validity of your requests.

Also, though it should go without saying, please make sure to use https for your webhook endpoint(s).

---

<div class="post-metadata">

**Author:** ![AGabay9](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/agabay9/32/52876_2.png) [@AGabay9](https://community.hubspot.com/u/AGabay9)\
**Post date:** [May 10, 2021, 9:01am UTC](https://community.hubspot.com/t/api-ip-addresses-firewall-whitelisting/11277/5 "2021-05-10T09:01:42Z")

</div>

Hi [@Derek\_Gervais](https://community.hubspot.com/t5/user/viewprofilepage/user-id/142) I see this is a very old post. Maybe now you have a allowlist of IPs?

---

<div class="post-metadata">

**Author:** ![tonypony](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/tonypony/32/53869_2.png) [@tonypony](https://community.hubspot.com/u/tonypony)\
**Post date:** [July 28, 2021, 8:54am UTC](https://community.hubspot.com/t/api-ip-addresses-firewall-whitelisting/11277/6 "2021-07-28T08:54:18Z")

</div>

Hi there  
Did you ever come right with public IPs?