For our company, it is of paramount importance to be able to ensure that all incoming traffic is safe and secure, before it enters our system. Currently, the only way to secure calls from HubSpot via WebHooks is via the X-HubSpot-Signature header. Verifying this header can only be accomplished in code. In other words, the call has already entered our system before we can check whether it is bona fide. Ideally, mutual TLS or the allowlisting of a range of IP-addresses should be available as a security option. Please make available a security setup that goes beyond the mere adding of a signature to webhooks notifications.
