# Stripe Webhook Authentication **URL:** \ **Category:** APIs\ **Created:** [September 29, 2016, 8:22am UTC](https://forum.bubble.io/t/stripe-webhook-authentication/6475 "2016-09-29T08:22:41Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![csblack](https://avatars.discourse-cdn.com/v4/letter/c/7feea3/32.png) [@csblack](https://forum.bubble.io/u/csblack)\ **Post date:** [September 29, 2016, 8:22am UTC](https://forum.bubble.io/t/stripe-webhook-authentication/6475/1 "2016-09-29T08:22:41Z")
[Stripe’s webhook documentation](https://stripe.com/docs/webhooks) says they support basic authentication. If I generate an API token in Bubble, how do I set this up in Stripe? Does it just need to go in the URL? I know I could run the API endpoint without authentication, but I’d rather not. ---
**Author:** ![stephencharles](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/stephencharles/32/24410_2.png) [@stephencharles](https://forum.bubble.io/u/stephencharles)\ **Post date:** [October 22, 2016, 5:59pm UTC](https://forum.bubble.io/t/stripe-webhook-authentication/6475/2 "2016-10-22T17:59:52Z")
@csblack Did you ever figure out the best way to authenticate on Stripe? ---
**Author:** ![csblack](https://avatars.discourse-cdn.com/v4/letter/c/7feea3/32.png) [@csblack](https://forum.bubble.io/u/csblack)\ **Post date:** [October 22, 2016, 6:02pm UTC](https://forum.bubble.io/t/stripe-webhook-authentication/6475/3 "2016-10-22T18:02:51Z")
No, I don’t think I ever got an answer to this one. ---
**Author:** ![stephencharles](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/stephencharles/32/24410_2.png) [@stephencharles](https://forum.bubble.io/u/stephencharles)\ **Post date:** [October 22, 2016, 7:24pm UTC](https://forum.bubble.io/t/stripe-webhook-authentication/6475/4 "2016-10-22T19:24:53Z")
@emmanuel Hi Emmanuel, should we be authenticating endpoints with Stripe? If there is no authentication, is it possible for someone to send data to an endpoint that is not Stripe? It looks like in your example you do not use authentication… > **[Bubble Editor - Meta\_public](https://bubble.io/page?type=api&id=meta_public&tab=tabs-2)** > > Build stuff without code and launch a startup without a tech-cofounder! Bubble is a visual programing language. Instead of typing code, use a visual editor to build applications. ---
**Author:** ![emmanuel](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/emmanuel/32/27657_2.png) [@emmanuel](https://forum.bubble.io/u/emmanuel)\ **Post date:** [October 22, 2016, 8:32pm UTC](https://forum.bubble.io/t/stripe-webhook-authentication/6475/5 "2016-10-22T20:32:59Z")
Yes, because what we use is the event id, that uses the Stripe plugin and our key. So if someone malicious wants to hit our API wf, the wf won’t run because the event id won’t be valid. Look at the workflow. ---
**Author:** ![kevin4](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/kevin4/32/59688_2.png) [@kevin4](https://forum.bubble.io/u/kevin4)\ **Post date:** [December 20, 2020, 4:52pm UTC](https://forum.bubble.io/t/stripe-webhook-authentication/6475/6 "2020-12-20T16:52:38Z")
Emmanuel… I’m not understanding how the use of the event id provides a level of authentication. Can you please elaborate on this? ---
**Author:** ![techspot](https://avatars.discourse-cdn.com/v4/letter/t/46a35a/32.png) [@techspot](https://forum.bubble.io/u/techspot)\ **Post date:** [April 17, 2021, 6:16pm UTC](https://forum.bubble.io/t/stripe-webhook-authentication/6475/7 "2021-04-17T18:16:19Z")
@kevin4 were you able to find out a way to use stripe endpoint without marking “This endpoint can be run without authentication” as checked? ---
**Author:** ![kurgat1.kipkoech](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/kurgat1.kipkoech/32/91996_2.png) [@kurgat1.kipkoech](https://forum.bubble.io/u/kurgat1.kipkoech)\ **Post date:** [April 17, 2021, 6:48pm UTC](https://forum.bubble.io/t/stripe-webhook-authentication/6475/8 "2021-04-17T18:48:11Z")
i can help you setup your stripe webhook, if i can take a look at your setup ---
**Author:** ![kevin4](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/kevin4/32/59688_2.png) [@kevin4](https://forum.bubble.io/u/kevin4)\ **Post date:** [April 18, 2021, 1:01pm UTC](https://forum.bubble.io/t/stripe-webhook-authentication/6475/9 "2021-04-18T13:01:57Z")
Sorry, I just saw this now, 4 months later. The short answer is “no”, but I found some documentation somewhere about why that isn’t a problem and why it can’t be abused. I’m not sure where I found that documentation, but I moved on at that point and worked on other aspects of the application. ---
**Author:** ![NigelG](https://avatars.discourse-cdn.com/v4/letter/n/ea5d25/32.png) [@NigelG](https://forum.bubble.io/u/NigelG)\ **Post date:** [April 18, 2021, 6:42pm UTC](https://forum.bubble.io/t/stripe-webhook-authentication/6475/10 "2021-04-18T18:42:49Z")
Can you base64 decode the Bubble token ? Then add that to the webhook URL? ```auto https://username:password@mybubbleapp.com ``` ---
**Author:** ![NigelG](https://avatars.discourse-cdn.com/v4/letter/n/ea5d25/32.png) [@NigelG](https://forum.bubble.io/u/NigelG)\ **Post date:** [April 19, 2021, 6:36am UTC](https://forum.bubble.io/t/stripe-webhook-authentication/6475/11 "2021-04-19T06:36:37Z")
So no… 1. Decoding a Bubble Basic token doesn’t give you a username:password 2. You can’t URL encode it and pass it as there are invalid characters 3. You can’t pass a user email and password from your app erm… so no. What you could do is use the signing secret to check if it was Stripe that sent it. But that looks complicated!