Is the IP address from which the webhook from EventSub is accessed and its range fixed?

[tunacook]

I am planning to receive notifications from Twitch Drops from EventSub.
In this case, I would like to ensure that the webhook is issued from Twitch’s EventSub.

However, we would like to allow only a limited number of access sources without exposing the endpoints.

Will the access source of the webhook issued from EventSub be a fixed IP address?
Or is there no fixed one?

Handling Webhook Events

In your 2018 post, you ask us to make a decision based solely on the Secret, has that changed?

Ip Range for twitch api

Twitch uses AWS. Which means at any given point it can and will change, as and when more server spin up/down. I don’t think it’s a static pool, but I’ll poke someone relevant… That said, it’s the purpose of the secret rather than known IP’s to secure the webhook

[BarryCarlyon]

There is no op address range published as aws is used and servers added/removed as needed

Only twitch will have your secret used to create a webhooks

You can also use the entitlements api instead

[tunacook]

Thanks for the reply!

It seems that in the entitlementgrant, I can set an arbitrary value for the secret attribute in the Transport and match it.

EventSub Subscription Types

[BarryCarlyon]

The http post doesn’t give you the secret back. The secret is used to verify the incoming payload.

Handling Webhook Events