Whitelisting Webhook Server IP Addresses

Because the Webhooks v3 cloud-based infrastructure runs on Amazon Web Services, there’s no simple way to whitelist server IP addresses: after all, individual servers can come and go at any time, and IP addresses can appear and reappear seemingly at random. To be on the safe side, you’d have to whitelist the entire range of IP addresses allocated to the Akamai Identity Cloud.

If you’re concerned about verifying the validly of event notifications, a better approach might be to verify the signature on each notification: if the signature is valid then the notification is valid.