IP Address for API Endpoints

User Support API
,
1

I am writing APIs to automatically fetch data from Kobo’s platform and integrate to my systems using Webhooks.

I wanted to know the IP address used to call these webhooks so that we can whitelist those IPs from our internal servers.

Would really appreciate if you can help me with this, I am blocked because of it.

2

Hello!
KoboToolbox does not provide fixed IP addresses for webhook calls due to their dynamic infrastructure. Instead of IP whitelisting, which is unreliable, you should secure your API endpoints using a secret token or HMAC request signing. Configure this within your KoboToolbox webhook tollbyplate settings and validate the token or signature in your API endpoint to ensure the requests are genuinely from KoboToolbox. Refer to KoboToolbox’s documentation for specific implementation details on these security methods.

3

Thank you.
I would appreciate any guidance or references on the following:

  • How to configure HMAC authentication in KoboToolbox webhook settings?
  • Are there any official documentation links or step-by-step guides available for this?
  • What is the expected format of the HMAC signature sent by KoboToolbox (e.g., hashing algorithm, headers used)?
  • How can I verify the HMAC signature on the receiver (server) side?

Any help or pointers from the community would be greatly appreciated.