Guides / Webhooks
IP addresses
Weav sends every webhook from these two IP addresses. If your firewall only lets known addresses in, allow both.
| IP address | Version |
|---|---|
18.136.62.102 |
IPv4 |
18.139.176.153 |
IPv4 |
Where they apply
- Every webhook Weav sends: to your webhook URL, your
withdrawals_url, and a payment’s ownwebhook_url. - Live and test mode alike, first attempts and retries.
- Webhooks come only from these addresses. Your calls to Weav are a different direction: send them to
api.weavpayments.comby name, never by IP.
Allow both
Add both addresses to your firewall, load balancer or web application firewall rules for your webhook URL. Weav may send from either one, so allowing only one makes some deliveries fail. A webhook your server doesn’t answer with 2xx is retried (see Retries).
An address isn’t proof that a webhook came from Weav. Always verify the signature too: the allowlist keeps others out of your endpoint, and the signature proves the payload is Weav’s and unchanged.
Changes
Changes to these addresses are announced in the changelog.
This list is for webhooks Weav sends you. To limit where your own API calls come from, use your key’s IP allowlist.