# Stripe Webhook Authentication Error **URL:** \ **Category:** APIs\ **Created:** [March 13, 2022, 3:29pm UTC](https://forum.bubble.io/t/stripe-webhook-authentication-error/195895 "2022-03-13T15:29:25Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![ian11](https://avatars.discourse-cdn.com/v4/letter/i/c57346/32.png) [@ian11](https://forum.bubble.io/u/ian11)\ **Post date:** [March 13, 2022, 3:29pm UTC](https://forum.bubble.io/t/stripe-webhook-authentication-error/195895/1 "2022-03-13T15:29:25Z")
I’m setting up a stripe webhook to listen for subscription cancellations. I successfully initialized the webhook and sent data from Stripe to Bubble. Then, I removed the “Initialize” at the end of my endpoint URL and tested it again. This time Stripe gave me an error… ![image](https://us1.discourse-cdn.com/bubble/original/3X/5/1/51fe396749c28727c3fbfcb63fb4c3cfaefba1db.png) { “error\_class”: “Unauthorized”, “args”: { “code”: “1647185057144x214012127239536540” }, “message”: null, “translation”: “You must authenticate to call this method” } I have the stripe app and the stripe.js app installed with the correct keys - is there something else I need to do to Authenticate? ---
**Author:** ![johnny](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/johnny/32/203020_2.png) [@johnny](https://forum.bubble.io/u/johnny)\ **Post date:** [March 13, 2022, 5:16pm UTC](https://forum.bubble.io/t/stripe-webhook-authentication-error/195895/2 "2022-03-13T17:16:55Z")
Hi there @ian11, In your backend workflow you need to let it run without authentication. ---
**Author:** ![ian11](https://avatars.discourse-cdn.com/v4/letter/i/c57346/32.png) [@ian11](https://forum.bubble.io/u/ian11)\ **Post date:** [March 13, 2022, 5:49pm UTC](https://forum.bubble.io/t/stripe-webhook-authentication-error/195895/3 "2022-03-13T17:49:08Z")
Doh! Of course. So simple… thank you! ---
**Author:** ![nico.dicagno](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/nico.dicagno/32/207961_2.png) [@nico.dicagno](https://forum.bubble.io/u/nico.dicagno)\ **Post date:** [April 9, 2022, 2:08pm UTC](https://forum.bubble.io/t/stripe-webhook-authentication-error/195895/4 "2022-04-09T14:08:41Z")
> [@johnny](#): > > In your backend workflow you need to let it run without authentication. Is this a good practice? API worflows which are activated by stripe webhooks deal with payments and sensitive data. Don’t want anybody who isnt stripe activating this workflow. There must be a way to check for authentication. ---
**Author:** ![johnny](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/johnny/32/203020_2.png) [@johnny](https://forum.bubble.io/u/johnny)\ **Post date:** [April 9, 2022, 6:50pm UTC](https://forum.bubble.io/t/stripe-webhook-authentication-error/195895/5 "2022-04-09T18:50:56Z")
I haven’t figure out a way to pass in a key in stripe for the webhook. ---
**Author:** ![dforde](https://avatars.discourse-cdn.com/v4/letter/d/b5a626/32.png) [@dforde](https://forum.bubble.io/u/dforde)\ **Post date:** [October 12, 2022, 7:41pm UTC](https://forum.bubble.io/t/stripe-webhook-authentication-error/195895/6 "2022-10-12T19:41:18Z")
Second to this, I had the same problem but it was due to my account being on the FREE version of bubble. Upgrade and you should see a difference if you’ve tried the authentication without prevail. ---
**Author:** ![cdorozco16](https://avatars.discourse-cdn.com/v4/letter/c/bbce88/32.png) [@cdorozco16](https://forum.bubble.io/u/cdorozco16)\ **Post date:** [August 17, 2023, 5:08pm UTC](https://forum.bubble.io/t/stripe-webhook-authentication-error/195895/7 "2023-08-17T17:08:48Z")
You can do this but it’s unsecured. ANyone can pretend to be stripe and send data to your endpoint. Read posts on ‘authenticating’ stripe webhooks for workarounds ---
**Author:** ![cheddabrat](https://avatars.discourse-cdn.com/v4/letter/c/a698b9/32.png) [@cheddabrat](https://forum.bubble.io/u/cheddabrat)\ **Post date:** [November 4, 2024, 6:53pm UTC](https://forum.bubble.io/t/stripe-webhook-authentication-error/195895/8 "2024-11-04T18:53:01Z")
I had this same problem. > Leave “this workflow can be run without authentication” box UNchecked. > Go to your Bubble settings \> API \> Generate a token or use what’s already there \> go to your Stripe webhooks \> at the end of the URL type: > ?api\_token=“your token” > save \> re-run your workflow event. No more authentication error AND you don’t have to run it without authentication. All credit goes to the team at Cranford Tech. For a video demonstration, check out their video [Shopping Cart Payments with Multiple Sellers (Stripe Connect) - Bubble.io Tutorial](https://youtu.be/K5i1KRFP_Wg?si=VF5hyE5Y7svnfczE). Particularly time 17:16-28:29 ---
**Author:** ![johnny](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/johnny/32/203020_2.png) [@johnny](https://forum.bubble.io/u/johnny)\ **Post date:** [November 4, 2024, 7:06pm UTC](https://forum.bubble.io/t/stripe-webhook-authentication-error/195895/9 "2024-11-04T19:06:23Z")
That’s no super safe either. If someone hacks your Stripe account or sees the link of your webhook URL somewhere they would have an admin API token to your app What I’ve been doing is: 1. Creating an API endpoint, not requiring authentication, and ignoring privacy rules 2. Creating an option set with [Stripe’s webhook IPs](https://docs.stripe.com/ips) 3. Add a condition to my backend WF to only run when the `cf-connecting-ip` contains one of the IPs in that option set. (make sure to check “detect headers” when you’re initializing your backend workflow) ---
**Author:** ![cheddabrat](https://avatars.discourse-cdn.com/v4/letter/c/a698b9/32.png) [@cheddabrat](https://forum.bubble.io/u/cheddabrat)\ **Post date:** [November 9, 2024, 5:50pm UTC](https://forum.bubble.io/t/stripe-webhook-authentication-error/195895/10 "2024-11-09T17:50:36Z")
I like that better. User security is paramount ---
**Author:** ![gaurav1](https://avatars.discourse-cdn.com/v4/letter/g/ee59a6/32.png) [@gaurav1](https://forum.bubble.io/u/gaurav1)\ **Post date:** [January 24, 2025, 2:55pm UTC](https://forum.bubble.io/t/stripe-webhook-authentication-error/195895/11 "2025-01-24T14:55:03Z")
> [@johnny](#): > > `cf-connecting-ip` Nice suggestion. So should this work fine as a condition - “Request data’s headers cf-connecting-ip contains All Stripe Webhook IPs:random item’s display” ? ---
**Author:** ![johnny](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/johnny/32/203020_2.png) [@johnny](https://forum.bubble.io/u/johnny)\ **Post date:** [January 24, 2025, 8:22pm UTC](https://forum.bubble.io/t/stripe-webhook-authentication-error/195895/12 "2025-01-24T20:22:19Z")
not random item; each item ---
**Author:** ![gaurav1](https://avatars.discourse-cdn.com/v4/letter/g/ee59a6/32.png) [@gaurav1](https://forum.bubble.io/u/gaurav1)\ **Post date:** [January 26, 2025, 11:49am UTC](https://forum.bubble.io/t/stripe-webhook-authentication-error/195895/13 "2025-01-26T11:49:25Z")
hey thanks! it worked. I have also created a workflow to update the IPs periodically. ---
**Author:** ![johnny](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/johnny/32/203020_2.png) [@johnny](https://forum.bubble.io/u/johnny)\ **Post date:** [January 26, 2025, 9:38pm UTC](https://forum.bubble.io/t/stripe-webhook-authentication-error/195895/14 "2025-01-26T21:38:22Z")
The IPs don’t change very often. I personally make it an option set and when Stripe sends a notice that they are adding/removing webhook IPs, I then make the adjustment. ---
**Author:** ![gaurav1](https://avatars.discourse-cdn.com/v4/letter/g/ee59a6/32.png) [@gaurav1](https://forum.bubble.io/u/gaurav1)\ **Post date:** [January 29, 2025, 10:23am UTC](https://forum.bubble.io/t/stripe-webhook-authentication-error/195895/15 "2025-01-29T10:23:09Z")
Ahh that sounds logical. And easier. Appreciate.