# Stripe webhook: What privacy rules? **URL:** \ **Category:** APIs\ **Created:** [December 10, 2022, 7:32am UTC](https://forum.bubble.io/t/stripe-webhook-what-privacy-rules/236482 "2022-12-10T07:32:59Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![jayy](https://avatars.discourse-cdn.com/v4/letter/j/43a26b/32.png) [@jayy](https://forum.bubble.io/u/jayy)\ **Post date:** [December 10, 2022, 7:32am UTC](https://forum.bubble.io/t/stripe-webhook-what-privacy-rules/236482/1 "2022-12-10T07:32:59Z")
I’m listening to Stripe events (namely checkout session completed) via a webhook (i.e. backend workflows). Is it okay to check all these boxes? Any security/privacy concerns? Thanks! ![image](https://us1.discourse-cdn.com/bubble/original/3X/6/3/63e40cc83073b09e2d4e01ee30ffe36a08e49e35.png) I’m afraid if i disable one of these, something might not work. ---
**Author:** ![lindsay\_knowcode](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/lindsay_knowcode/32/92967_2.png) [@lindsay\_knowcode](https://forum.bubble.io/u/lindsay_knowcode)\ **Post date:** [December 10, 2022, 1:29pm UTC](https://forum.bubble.io/t/stripe-webhook-what-privacy-rules/236482/3 "2022-12-10T13:29:24Z")
EDIT Authentication does need to be switched off (as you have to use other other methods to secure the endpoint with Stripe Webhooks) This post discusses it [http://forum.bubble.io/t/stripe-webhook-in-bubble-big-vulnerability-to-all-apps-that-use-them/134030/27](http://forum.bubble.io/t/stripe-webhook-in-bubble-big-vulnerability-to-all-apps-that-use-them/134030/27) You have to find out what you are personally comfortable with, and balance effort to implement vs what the risks are. For me - checking the source IP addresses matches any of Stripes IP addresses is low effort to implement and reduces a lot of risk … Good luck! ---
**Author:** ![jayy](https://avatars.discourse-cdn.com/v4/letter/j/43a26b/32.png) [@jayy](https://forum.bubble.io/u/jayy)\ **Post date:** [December 11, 2022, 1:19am UTC](https://forum.bubble.io/t/stripe-webhook-what-privacy-rules/236482/4 "2022-12-11T01:19:45Z")
Thanks guys. I disabled the 2nd checkbox and the webhook failed. It seems that I need to enable authentication, but I can’t find info on how to do this. Do you know of any writeup on this? Thanks! ![image](https://us1.discourse-cdn.com/bubble/original/3X/5/2/5294978d53c1926d15693c6308cdd46a0a245010.png) ---
**Author:** ![adamhholmes](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/adamhholmes/32/100510_2.png) [@adamhholmes](https://forum.bubble.io/u/adamhholmes)\ **Post date:** [December 11, 2022, 1:31am UTC](https://forum.bubble.io/t/stripe-webhook-what-privacy-rules/236482/5 "2022-12-11T01:31:44Z")
As I’m sure @lindsay_knowcode _meant_ to say (and as you’ve discovered for yourself), the ‘This workflow can be run without authentication’ box _must_ be checked for a Stripe webhook to work (_not_ unchecked)… So it’s up to you to validate the webhook on your end using the Stripe signature provided in the webhook header: [Check the webhook signatures | Stripe Documentation](https://stripe.com/docs/webhooks/signatures?locale=en-GB#verify-manually) ---
**Author:** ![lindsay\_knowcode](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/lindsay_knowcode/32/92967_2.png) [@lindsay\_knowcode](https://forum.bubble.io/u/lindsay_knowcode)\ **Post date:** [December 11, 2022, 6:42am UTC](https://forum.bubble.io/t/stripe-webhook-what-privacy-rules/236482/6 "2022-12-11T06:42:21Z")
Whoops typo … sorry about that … cheers @adamhholmes😬 ---
**Author:** ![jayy](https://avatars.discourse-cdn.com/v4/letter/j/43a26b/32.png) [@jayy](https://forum.bubble.io/u/jayy)\ **Post date:** [December 12, 2022, 1:41am UTC](https://forum.bubble.io/t/stripe-webhook-what-privacy-rules/236482/7 "2022-12-12T01:41:27Z")
oh right, thanks for that! so all 3 checkboxes need to be ticked to work properly, but we need to validate the webhook manually in the workflow. ---
**Author:** ![boston85719](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/boston85719/32/77286_2.png) [@boston85719](https://forum.bubble.io/u/boston85719)\ **Post date:** [March 29, 2023, 4:57pm UTC](https://forum.bubble.io/t/stripe-webhook-what-privacy-rules/236482/8 "2023-03-29T16:57:02Z")
Was just setting up some webhooks for first time in a long time and had the errors. After reading the forum threads, and deciding I don’t want to authenticate the way Stripe suggests with their own libraries etc. (I’m a NoCoder for Apps Sake!); I decided I will add a bit of metadata to my checkout session API calls that will be the ‘api token’ that I create. The metadata parameters will be private (ugghhh I wish I could be my four year old son who whipped it out on in the middle of the restaurant to relieve himself, and not have to worry about Privacy Concerns). When I have the webhook, I will in the backend workflow first verify that the metadata api key matches the value…if not, TERMINATE WORKFLOW! ---
**Author:** ![cdorozco16](https://avatars.discourse-cdn.com/v4/letter/c/bbce88/32.png) [@cdorozco16](https://forum.bubble.io/u/cdorozco16)\ **Post date:** [August 17, 2023, 6:19pm UTC](https://forum.bubble.io/t/stripe-webhook-what-privacy-rules/236482/9 "2023-08-17T18:19:58Z")
How are you hiding the token you send from the user’s client during the checkout session?