Restrict Webhook Access With Authentication and IP Allowlisting

Public webhook URLs are discoverable through URL scanning and can be abused for data injection, denial of service, or triggering unintended workflow executions. Always add at least one layer of authentication to sensitive webhook endpoints.

Real-world example: An n8n webhook endpoint creates records in a production database. An attacker discovers the URL and sends thousands of crafted POST requests, inserting garbage data.

Method 1: Header Authentication (simplest)

Configure the Webhook node:

Setting	Value
Authentication	Header Auth
Header Name	X-Webhook-Secret
Header Value	(create a credential with a strong random value)

Callers must include the header:

curl -X POST https://n8n.example.com/webhook/your-path \
  -H "X-Webhook-Secret: your-random-secret-value" \
  -H "Content-Type: application/json" \
  -d '{"event": "order.created", "data": {...}}'
```text
**Method 2: IP Allowlisting via Nginx**

```nginx

# Inside the server block, restrict webhook paths by IP

location /webhook/ {
    # Only allow requests from known IP ranges

    allow 52.31.0.0/16;    # Stripe webhook IPs

    allow 192.30.252.0/22; # GitHub webhook IPs

    allow 10.0.0.0/8;      # Internal network

    deny all;

    proxy_pass http://127.0.0.1:5678;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}
```text
**Method 3: Basic Auth for internal tools**

Configure the Webhook node:

| Setting | Value |
|:--------|:------|
| Authentication | Basic Auth |
| Credential | (create a Basic Auth credential with username/password) |

> **Tip: Combine Methods**
>
> For maximum protection on critical webhooks, use IP allowlisting at the Nginx layer AND header authentication in the Webhook node. This provides defense in depth -- even if one layer is bypassed, the other blocks unauthorized access.

**Related:** [Use Docker Compose with Health Checks for n8n and PostgreSQL](../self-hosting-operations/01-use-docker-compose-with-health-checks-for-n8n-and-postgresql.md) | [Use Path Parameters in Webhook URLs for Dynamic Routing](../webhook-mastery/01-use-path-parameters-in-webhook-urls-for-dynamic-routing.md)