Stripe uses 15 prefixes for Webhooks.
Short answer
Webhooks lists the addresses Stripe sends webhook events from. Stripe recommends verifying the signature as well as the source address.
Prefixes
What changed
No prefixes added or removed since we started tracking this list. Changes appear here the day after the provider publishes them.
Allowlist formats
nginx (first 5 prefixes)
allow 13.235.122.149/32; allow 13.235.14.237/32; allow 18.211.135.69/32; allow 3.120.168.93/32; allow 3.130.192.231/32; deny all;
iptables (first 5 prefixes)
iptables -A INPUT -s 13.235.122.149/32 -j ACCEPT iptables -A INPUT -s 13.235.14.237/32 -j ACCEPT iptables -A INPUT -s 18.211.135.69/32 -j ACCEPT iptables -A INPUT -s 3.120.168.93/32 -j ACCEPT iptables -A INPUT -s 3.130.192.231/32 -j ACCEPT
Generate the full list from the CSV, and refresh it on a schedule: providers add and retire prefixes often.
Sources
- Stripe: published IP ranges · checked 5 Nov 2026
- Stripe documentation