dubai_4u-webhook

[sacred oyster]

hi!
1.
they're public IP addresses, they're listed on https://stripe.com/docs/ips#webhook-notifications
2.
you could check the IP address of the incoming connection against that list. You can also check the cryptographic signature on the event itself for authenticity. https://stripe.com/docs/webhooks/signatures