1

If I implement a webhook, it basically allows anyone to call that endpoint. As this would be a public URL.

From security point of view, I should only consume event notifications coming only from Marketing Cloud.

How do I secure my webhook and whitelist only Marketing Cloud? I did not find any official documentation from Marketing Cloud about this.

2

I will suggest starting by solving it with IP whitelisting in your webhook service. The IPs you need to allow for communication between Marketing Cloud and your endpoint depend on the stack on which your MC resides.

You can find all the IP addresses on this page, under Instance-Specific IP Addresses. For example, if your instance resides on stack 6, you should allow your endpoint to receive traffic from following IP adresses:

68.232.200.1
68.232.200.2
68.232.200.3
207.67.38.42
198.245.87.251
13.111.27.193
13.111.27.194
13.111.27.195
13.111.27.196

You should also have a look at this sequence diagram explaining the process of integrating MC with your endpoint (source):

enter image description here

As described in the documentation all the callbacks are signed, and can be validated by looking at their HMAC-SHA256 signature.

Combining both IP whitelisting and signing, will ensure you only accept valid calls to your endpoint.

| improve this answer | |
  • thanks Lukas, do we have Token concept in Marketing Cloud? Like in Slack webhook calls, it passes a token and we just validate the token in webhook call? – San Tosh Sep 18 at 10:50
  • 1
    @SanTosh - updated my answer with details on signing of callbacks. – Lukas Lunow Sep 18 at 10:59
  • that sounds awesome! thanks again Lukas! – San Tosh Sep 18 at 11:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.