If I implement a webhook, it basically allows anyone to call that endpoint. As this would be a public URL.

From security point of view, I should only consume event notifications coming only from Marketing Cloud.

How do I secure my webhook and whitelist only Marketing Cloud? I did not find any official documentation from Marketing Cloud about this.

1 Answer 1


I will suggest starting by solving it with IP whitelisting in your webhook service. The IPs you need to allow for communication between Marketing Cloud and your endpoint depend on the stack on which your MC resides.

You can find all the IP addresses on this page, under Instance-Specific IP Addresses. For example, if your instance resides on stack 6, you should allow your endpoint to receive traffic from following IP adresses:

You should also have a look at this sequence diagram explaining the process of integrating MC with your endpoint (source):

enter image description here

As described in the documentation all the callbacks are signed, and can be validated by looking at their HMAC-SHA256 signature.

Combining both IP whitelisting and signing, will ensure you only accept valid calls to your endpoint.

  • thanks Lukas, do we have Token concept in Marketing Cloud? Like in Slack webhook calls, it passes a token and we just validate the token in webhook call?
    – ipradhansk
    Commented Sep 18, 2020 at 10:50
  • 1
    @SanTosh - updated my answer with details on signing of callbacks. Commented Sep 18, 2020 at 10:59
  • that sounds awesome! thanks again Lukas!
    – ipradhansk
    Commented Sep 18, 2020 at 11:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .