Notifications - Tatum IPs, WAF and HMAC

Modified on Tue, 03 Jan 2023 at 03:08 PM

Tatum supports HMAC webhook digest for those that want to verify their origin. 

With HMAC, each notification fired by Tatum has within the HTTP header a digest in the x-payload-hash field, which users can reconstruct on their end. More information is available at the following link.


Alternatively, although not recommended, you can whitelist Tatum IPs in your Web Application Firewall (WAF). Tatum uses Cloudflare services where IP ranges are mentioned in the following article


HMAC Advantages

  • You can trust the webhook content wasn't changed by a "Man-in-the-middle", otherwise, the digest will not match
  • You can trust that only Tatum could calculate the hash, hence you can trust the request was fired by Tatum and not an attacker


Using HMAC is a much more reliable approach compared to IPs whitelisting.

Was this article helpful?

That’s Great!

Thank you for your feedback

Sorry! We couldn't be helpful

Thank you for your feedback

Let us know how can we improve this article!

Select atleast one of the reasons

Feedback sent

We appreciate your effort and will try to fix the article