Webhook requests not originating from the IP's coming in response of https://api.us.nylas.com/v3/webhooks/ip-addresses

Question and Answers
1

I am getting requests from different source IP’s apart from the one coming in the response of mentioned endpoint, I have raised a support ticket as well for this #91861 with the additional details.

Requests coming from IP: [ 34.45.57.130 ,34.171.164.149]

IP array coming in response: [
“35.188.63.45”,
“34.133.164.121”,
“34.70.83.96”,
“34.134.116.130”,
“104.154.146.112”,
“34.171.143.250”,
“34.67.252.55”,
“35.224.166.183”,
“35.188.78.243”,
“35.239.163.136”,
“35.232.148.243”,
“34.170.82.10”,
“34.136.198.56”,
“35.192.113.172”,
“34.136.150.230”,
“34.123.138.135”,
“35.192.130.13”,
“34.135.60.227”,
“34.133.89.88”,
“35.225.218.9”,
“35.225.43.58”,
“34.171.101.162”,
“35.224.160.23”,
“34.122.166.13”,
“34.133.227.251”,
“34.173.53.83”,
“34.171.202.71”,
“34.134.249.164”,
“35.232.0.99”,
“35.224.53.151”,
“34.171.140.159”,
“35.238.228.54”,
“34.67.117.182”,
“35.192.145.204”,
“35.239.61.110”,
“34.172.89.235”,
“35.193.156.3”,
“34.136.8.102”,
“34.172.75.151”,
“34.172.179.208”,
“104.154.214.119”,
“34.122.157.170”,
“35.193.50.12”,
“34.134.217.67”,
“34.67.39.103”,
“34.134.71.20”,
“34.172.98.72”,
“107.178.222.216”
]

Please provide some insights into this issue.

2

Hello @Deeptanshu Let me check with the team and will get back to you

3

@Deeptanshu According to our docs

These IP addresses change frequently, so you should not attempt to allowlist the results, but instead should check this endpoint periodically, or consider using a PubSub notification channel instead of webhooks.

You can (and should) also be validating incoming webhooks, so even if the IP addresses don’t match you still have an opportunity to validate that they’re legit webhooks coming from Nylas.