# Webhook origin domain/subdomain

**URL:** <https://discuss.dwolla.com/t/webhook-origin-domain-subdomain/6646>\
**Category:** Other\
**Created:** [January 18, 2021, 5:23pm UTC](https://discuss.dwolla.com/t/webhook-origin-domain-subdomain/6646 "2021-01-18T17:23:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![PriyanshuJain](https://avatars.discourse-cdn.com/v4/letter/p/3e96dc/32.png) [@PriyanshuJain](https://discuss.dwolla.com/u/PriyanshuJain)\
**Post date:** [January 18, 2021, 5:23pm UTC](https://discuss.dwolla.com/t/webhook-origin-domain-subdomain/6646/1 "2021-01-18T17:23:46Z")

</div>

Hi - What is the domain/subdomain of the service that sends webhooks? I need to whitelist the origin domain name before I could set up webhooks. I tried with whitelisting `https://api-sandbox.dwolla.com` but it didn’t work. We have a Django based application. Thanks in advance.

---

<div class="post-metadata">

**Author:** ![kmoreira](https://sea2.discourse-cdn.com/dwolla/user_avatar/discuss.dwolla.com/kmoreira/32/2718_2.png) [@kmoreira](https://discuss.dwolla.com/u/kmoreira)\
**Post date:** [January 19, 2021, 3:02pm UTC](https://discuss.dwolla.com/t/webhook-origin-domain-subdomain/6646/2 "2021-01-19T15:02:02Z")

</div>

Hi @PriyanshuJain

We do not currently support whitelisting out domain. We’re in AWS and our IPs are dynamically allocated. We don’t have a range defined to where they could be whitelisted.

Instead, we recommend validating webhooks using the signature that we sign each webhooks with.

---

<div class="post-metadata">

**Author:** ![PriyanshuJain](https://avatars.discourse-cdn.com/v4/letter/p/3e96dc/32.png) [@PriyanshuJain](https://discuss.dwolla.com/u/PriyanshuJain)\
**Post date:** [January 19, 2021, 7:17pm UTC](https://discuss.dwolla.com/t/webhook-origin-domain-subdomain/6646/3 "2021-01-19T19:17:22Z")

</div>

@kmoreira Thanks for the response. We only allow a certain list of origins to our server. I will look for a solution to allow any origin for the webhook API. Meanwhile, Is there any domain/subdomain where all your dynamic IP resolve from reverse IP lookup?

---

<div class="post-metadata">

**Author:** ![dalurness](https://avatars.discourse-cdn.com/v4/letter/d/7993a0/32.png) [@dalurness](https://discuss.dwolla.com/u/dalurness)\
**Post date:** [October 8, 2021, 3:45pm UTC](https://discuss.dwolla.com/t/webhook-origin-domain-subdomain/6646/4 "2021-10-08T15:45:43Z")

</div>

Is this still the case? It would be great if there was an option to receive the webhooks from a specified origin domain for django.

---

<div class="post-metadata">

**Author:** ![kmoreira](https://sea2.discourse-cdn.com/dwolla/user_avatar/discuss.dwolla.com/kmoreira/32/2718_2.png) [@kmoreira](https://discuss.dwolla.com/u/kmoreira)\
**Post date:** [October 8, 2021, 4:28pm UTC](https://discuss.dwolla.com/t/webhook-origin-domain-subdomain/6646/5 "2021-10-08T16:28:11Z")

</div>

Hi @dalurness

Yes, this is still accurate