About Zapier Community
New to our Community? Get to know more about our space and how to make the most of your time here.

Code of Conduct Community FAQ's Zapier Common Questions What to Expect

Get Started With Zapier
New to Zapier? We have got you covered with our Zapier 101 Resources.

Zapier Essentials

Get Support
Have a question? Let's get you an answer!

How Do I...? Troubleshooting Code & Webhooks Developer Zone

Other Help Resources
Wait, there's more! Check out these Community sourced spaces for additional resources.

Zapier Help Center Hire an Expert

Zapier Reading
All of our best learning resources can be found here.

Featured Articles Show & Tell AI Hub Zapier Tools Hub

Learning Groups
Excited to meet other builders? Check out our interest areas full of doers, dreamers, and in-betweeners.

User Groups

Other Learning Resources
Some of our favorite additional ways to upskill your Zapier knowledge.

Zapier Learn Zapier Blog Zapier Webinars

Product Updates
Check out what is new and upcoming with Zapier with our regular product updates.

Product Updates

Early Access Program
Want to join Early Access? Learn more here.

Question

Webhook incoming authentication & security

  • 6 April 2021
  • 1 reply
  • 2853 views
J

Hey All, new to Zapier here. Awesome product this. Has all the “Actions” I need and was easily able to test a bunch of them now. Currently my situation is this:

  • I have an app running on our server and when something specific happens we are going to send a post to a Zapier Webhook or to a Customer Zapier Platform Integration we’ve created for our private use and that will for instance send a MS Teams msg, send an email or a text msg.
  • My issue is this: I know on the generic “Webhooks By Zapier” you can’t add Basic Auth for incoming requests to the Zapier generated Webhook URL but what I want to do is for instance: Add Basic Auth or API Key for my Zapier Webhook generated URL so from my app I will send for instance Base64 Encoded user & password via the Authorization header to the Zapier generated url of say: https://hooks.zapier.com/hooks/catch/34234234/asdfasdf etc.  

Now I’m struggling how to set this up via my custom app on https://developer.zapier.com/ . It seems the authentication “Basic Auth” section on there is geared to when I want to call an endpoint that is using Basic Auth. Ideally I want to set a user & password and return a 401 for any incoming requests to the generated Webhook URL that do not have the correct credentials. I’ve seen multiple posts saying this is possible but nothing on how to do it and I’m obviously missing something here :( If anyone can help me out with this it would be greatly appreciated. Even if it’s something along the lines of setting an environmental variable and check the incoming header for this and return a 401? 

  • Secondly is there any way to white list incoming IP’s to this WebHook?

Thanx all!

 

James

 

This post has been closed for comments. Please create a new post if you need help or have a question about this topic.

1 reply

CraigNet3
Userlevel 4
Badge +4

@jjay225 all of this is possible. However, you’ll have to do this in the perform code for your trigger. Not the authentication section.

In the perform code you can hard code the values for the credentials and IP addresses that you want to allow.

Alternatively you could make an HTTP request to your external system to do this verification and avoid hardcoding any values into the Zapier code. This is the best option for maintainability and security.

Terms & Conditions