# Webhook User Agent

**URL:** <https://discuss.dev.twitch.com/t/webhook-user-agent/64817>\
**Category:** API\
**Created:** [July 4, 2026, 8:33pm UTC](https://discuss.dev.twitch.com/t/webhook-user-agent/64817 "2026-07-04T20:33:24Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![RealityRipple](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/realityripple/32/17042_2.png) [@RealityRipple](https://discuss.dev.twitch.com/u/RealityRipple)\
**Post date:** [July 4, 2026, 8:33pm UTC](https://discuss.dev.twitch.com/t/webhook-user-agent/64817/1 "2026-07-04T20:33:24Z")

</div>

The User Agent String used by Twitch’s Webhook system appears to be “Go-http-client/1.1”. More and more frequently, “Go-http-client” in user agent strings is starting to be blocked by services and servers, as many crawlers and vulnerability scanners use the same agent. I am aware that user-agent-based blocking is incredibly stupid to begin with, but would it be possible to use a more unique, descriptive agent string? Something maybe relevant to the fact it’s a Webhook, or from Twitch, or both?

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [July 4, 2026, 9:13pm UTC](https://discuss.dev.twitch.com/t/webhook-user-agent/64817/2 "2026-07-04T21:13:45Z")

</div>

> [@RealityRipple](#):
>
> I am aware that user-agent-based blocking is incredibly stupid to begin with

Whist I agree a user agent more description would be nice.

Surely you control what goes thru your security to hit your endpoints. So conceptually it’s a moot point, becuase you can configure security according to your needs. And if you can’t control/configure that, then you should consider alternative services imo.

And an attacker is just gonna use the known/documented Twitch Webhook User Agent when they want to attack anyway.

---

<div class="post-metadata">

**Author:** ![RealityRipple](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/realityripple/32/17042_2.png) [@RealityRipple](https://discuss.dev.twitch.com/u/RealityRipple)\
**Post date:** [July 4, 2026, 9:43pm UTC](https://discuss.dev.twitch.com/t/webhook-user-agent/64817/3 "2026-07-04T21:43:37Z")

</div>

Unfortunately, when using a webhost service, it’s their security, not your security. Because the world’s not complete with more stupid all around. 🙄

I have, in my case, contacted my host and opened a ticket, but it being a weekend and a holiday on top of that…

---

<div class="post-metadata">

**Author:** ![RealityRipple](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/realityripple/32/17042_2.png) [@RealityRipple](https://discuss.dev.twitch.com/u/RealityRipple)\
**Post date:** [July 13, 2026, 7:04pm UTC](https://discuss.dev.twitch.com/t/webhook-user-agent/64817/4 "2026-07-13T19:04:43Z")

</div>

The response from my host boils down to this line: “…is commonly used by automated bots and malicious HTTP requests. As a result, this User-Agent may be blocked by website security rules or web application firewalls.”

It sounds like they’re running their servers behind a security layer that they’re not responsible for, either. I just love how every task has been offloaded to someone else, so nobody’s ever responsible.

---

<div class="post-metadata">

**Author:** ![system](https://d2opxh93rbxzdn.cloudfront.net/original/2X/0/05909729875cce3b53e59d5561c4d23bb14948fc.png) [@system](https://discuss.dev.twitch.com/u/system)\
**Post date:** [August 12, 2026, 7:05pm UTC](https://discuss.dev.twitch.com/t/webhook-user-agent/64817/5 "2026-08-12T19:05:17Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.