Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It only takes a minute to sign up.
Sign up to join this community
If I implement a webhook, it basically allows anyone to call that endpoint. As this would be a public URL.
From security point of view, I should only consume event notifications coming only from Marketing Cloud.
How do I secure my webhook and whitelist only Marketing Cloud? I did not find any official documentation from Marketing Cloud about this.
I will suggest starting by solving it with IP whitelisting in your webhook service. The IPs you need to allow for communication between Marketing Cloud and your endpoint depend on the stack on which your MC resides.
You can find all the IP addresses on this page, under Instance-Specific IP Addresses. For example, if your instance resides on stack 6, you should allow your endpoint to receive traffic from following IP adresses:
68.232.200.1
68.232.200.2
68.232.200.3
207.67.38.42
198.245.87.251
13.111.27.193
13.111.27.194
13.111.27.195
13.111.27.196
You should also have a look at this sequence diagram explaining the process of integrating MC with your endpoint (source):
As described in the documentation all the callbacks are signed, and can be validated by looking at their HMAC-SHA256 signature.
Combining both IP whitelisting and signing, will ensure you only accept valid calls to your endpoint.
