Service

Stripe webhooks IP ranges

Stripe sends webhook events from these addresses. Restrict your webhook endpoint to them in addition to checking the signature.

The IPs Stripe sends webhook events from. An IP allowlist on your webhook endpoint is a useful second layer, but not a replacement for verifying the Stripe-Signature header on every event.

IPv4 prefixes: 15
IPv6 prefixes: 0
IPv4 addresses: 15
Updated: Oct 1, 2026

Is this IP Stripe webhooks?

Checks the address against the current list, in your browser.

Download the list

Generated from the current list.

Source: https://stripe.com/files/ips/ips_webhooks.json · official documentation

Prefixes by service

webhooks15

All prefixes

The list as of Oct 1, 2026; the page loads the latest copy when it opens.

Prefix	Region	Service
3.18.12.63/32		webhooks
3.69.109.8/32		webhooks
3.120.168.93/32		webhooks
3.130.192.231/32		webhooks
13.235.14.237/32		webhooks
13.235.122.149/32		webhooks
18.211.135.69/32		webhooks
35.154.171.200/32		webhooks
35.157.207.129/32		webhooks
52.15.183.38/32		webhooks
54.88.130.119/32		webhooks
54.88.130.237/32		webhooks
54.187.174.169/32		webhooks
54.187.205.235/32		webhooks
54.187.216.72/32		webhooks

Frequently asked questions

What are the IP ranges of Stripe webhooks?

Stripe webhooks publishes 15 IPv4 and 0 IPv6 prefixes (15 IPv4 addresses in total) in its official list at https://stripe.com/files/ips/ips_webhooks.json. This page shows the list as of Oct 1, 2026 and loads the latest copy when it opens.

How often do the Stripe webhooks IP ranges change?

Providers add and remove ranges regularly, sometimes several times a week. Do not hard-code the list: load it from its source (or this page's JSON) on a schedule, for example daily.

How do I allow only Stripe webhooks in nginx?

Download the nginx format on this page and include it in a location block: one 'allow' line per prefix followed by 'deny all;'. Regenerate the file regularly, because the list changes.

IP geolocation API

Know who is behind any IP

Beyond published lists, the ipbase API tells you the owner, ASN and location of every IP address, and on the Medium plan and above its data-center and VPN status, so you can recognise cloud traffic and bots from any provider.

Read the documentation

1,000 free requests every month. No credit card required.

GET https://api.ipbase.com/v2/info?ip=1.1.1.1

{
  "data": {
    "ip": "1.1.1.1",
    "type": "v4",
    "connection": {
      "asn": 13335,
      "organization": "APNIC and Cloudflare DNS Resolver project",
      "isp": "Cloudflare, Inc",
      "range": "1.1.1.0/24"
    },
    "location": {
      "country": { "alpha2": "AU", "name": "Australia" },
      "zip": "4000"
    },
    "security": { "is_vpn": null, "is_tor": null, "threat_score": null }
  }
}