Webhooks

Every Stream product can deliver events to your server using webhooks, SQS or SNS. When setting up a hook you can specify the exact events you want to receive, or select to receive all events.

To ensure that a webhook is triggered by Stream you can verify its signature. Webhook retries are in place. If you want to ensure an outage in your API never loses an event, it's better to use SQS or SNS for reliability.

The configuration can be done using the API or from the Dashboard. Some important points to consider:

  • The selection of events you want to receive applies to all the endpoints you have configured.
  • You can configure multiple endpoints for the same app (eg. AWS SNS and HTTP Webhook).
  • If your app is configured to receive all events, you can still filter the events you want to receive in your webhook handler.
  • If your app is configured to receive all events, newly introduced event types will be sent to your webhook handler by default.
  • If you pick specific events, newly introduced event types will not be sent to your webhook handler by default (you can still manually add them later on).

Event types and payloads are documented per product: Chat events, Video events and Moderation events.

Configuring Hooks

Here's how to quickly set up webhooks using the event_hooks configuration:

Subscribe to Specific Events

// Subscribe to message.new and message.updated events only
await client.updateAppSettings({
  event_hooks: [
    {
      enabled: true,
      hook_type: "webhook",
      webhook_url: "https://example.com/webhooks/stream/messages",
      event_types: ["message.new", "message.updated"],
    },
  ],
});

Subscribe to All Events

Use an empty event_types array to receive all existing and future events:

// Subscribe to all events (empty array = all events)
await client.updateAppSettings({
  event_hooks: [
    {
      enabled: true,
      hook_type: "webhook",
      webhook_url: "https://example.com/webhooks/stream/all",
      event_types: [], // empty array = all events
    },
  ],
});

Updating event_hooks replaces the whole array. Any previously existing hooks not included in the update will be deleted, so get the current app settings first and send back the complete list including your new hook.

For reliable event delivery, you can also configure SQS or SNS instead of webhooks.

Adding a Hook Without Deleting Existing Ones

An event_hooks update replaces the whole array: any previously existing hooks not included in it will be deleted. To add a hook, fetch the current configuration first and include the existing hooks in the update. The same pattern applies to SQS and SNS hooks.

// Note: Any previously existing hooks not included in event_hooks array will be deleted.
// Get current settings first to preserve your existing configuration.

// STEP 1: Get current app settings to preserve existing hooks
const response = await client.getAppSettings();
console.log("Current event hooks:", response.event_hooks);

// STEP 2: Add webhook hook while preserving existing hooks
const existingHooks = response.event_hooks || [];
const newWebhookHook = {
  enabled: true,
  hook_type: "webhook",
  webhook_url: "https://example.com/webhooks/stream/push",
  event_types: [], // empty array = all events
};

// STEP 3: Update with complete array including existing hooks
await client.updateAppSettings({
  event_hooks: [...existingHooks, newWebhookHook],
});

// Test the webhook connection
await client.testWebhookSettings({
  webhook_url: "https://example.com/webhooks/stream/push",
});

Debugging webhook requests with NGROK

The easiest way to debug webhooks is with NGROK.

  1. Start NGROK
brew install ngrok
ngrok http 8000

  1. Update your webhook URL to the NGROK url

  2. Trigger a webhook

  3. Open up the ngrok inspector

http://127.0.0.1:4040/inspect/http

Handling the Webhook

Your webhook handler needs to follow these rules:

  • accept HTTP POST requests with JSON payload
  • be reachable from the public internet. Tunneling services like Ngrok are supported
  • respond with response codes from 200 to 299 as fast as possible
  • be idempotent. Stream retries on network or 5xx errors, and retried calls carry the same X-Webhook-Id header
  • run over HTTPS with Keep-Alive enabled

We highly recommend following common security guidelines to make your webhook integration safe and fast:

  • Use HTTPS with a certificate from a trusted authority
  • Verify the "X-Signature" header to ensure the request is coming from Stream
  • Support HTTP Keep-Alive
  • Use a highly available infrastructure such as AWS Elastic Load Balancer, Google Cloud Load Balancer, or similar
  • Offload the processing of the message if possible (read, store, and forget)
  • When decoding JSON into objects, ensure that your webhook can handle new fields being added to the JSON payload as well as new event types (eg. log unknown fields and event types instead of failing)

All webhook requests contain these headers:

NameDescriptionExample
X-Webhook-IdUnique ID of the webhook call. This value is consistent between retries and could be used to deduplicate retry calls123e4567-e89b-12d3-a456-426614174000
X-Webhook-AttemptNumber of webhook request attempt starting from 11
X-Api-KeyYour application's API key. Should be used to validate request signaturea1b23cdefgh4
X-SignatureHMAC signature of the request body. See Signature sectionca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb

Verifying and Parsing Events

To verify and parse the event, call verifyAndParseWebhook on your Stream client. It transparently decompresses the body when Payload Compression is on (detected from the body bytes, so it works behind middleware that auto-decompresses the request) and verifies the HMAC X-Signature header using the API secret the client was constructed with. Every SDK returns a typed event object. Unknown event types fall back to an UnknownEvent shape so your handler keeps working when Stream introduces new ones.

Every failure mode (signature mismatch, gzip decompression failure, base64 decode failure, JSON parse failure) raises a single, language-idiomatic webhook error so you only need one catch arm. The message text identifies which mode fired, so callers that want to differentiate (security logging, retry policy) can filter on it:

LanguageError classFailure-mode messages
JavaScriptInvalidWebhookErrorsignature mismatch, invalid base64 encoding, gzip decompression failed, invalid JSON payload
PythonInvalidWebhookErrorsame
RubyStreamChat::Webhook::InvalidWebhookErrorsame
PHPInvalidWebhookExceptionsame (InvalidWebhookException::SIGNATURE_MISMATCH etc.)
Gosentinel getstream.ErrInvalidWebhooksame prefixes; use errors.Is(err, getstream.ErrInvalidWebhook) for the unified check
Javaio.getstream.Webhook.InvalidWebhookErrorsame (Webhook.InvalidWebhookError.SIGNATURE_MISMATCH etc.)
.NET (C#)StreamInvalidWebhookExceptionsame (StreamInvalidWebhookException.SignatureMismatch etc.)

Pass the raw body bytes and the X-Signature header value. The client already knows your API secret, so the call stays a two-argument one-liner.

// rawBody is the request body as Buffer or string (NOT a parsed JSON object).
// signature is the value of the x-signature header.
// Returns the parsed event object. Throws InvalidWebhookError on any failure.
try {
  const event = client.verifyAndParseWebhook(
    req.rawBody,
    req.headers["x-signature"],
  );
  // event.type, event.user, ...
} catch (err) {
  // err instanceof InvalidWebhookError; err.message identifies the mode
}

Where each argument comes from

ArgumentSourceExample
body / rawBodyRaw HTTP request body bytes (not a parsed JSON object)req.rawBody, request.body, request.data, r.Body (drained)
signatureX-Signature request headerreq.headers["x-signature"]

The API secret comes from the client you constructed at startup, so it's never passed into the helper.

Pass the raw body bytes, before any JSON parsing or string normalization. The helper hashes them as-is. In Express, enable express.raw({ type: 'application/json' }); in Django use request.body; in Flask use request.data; in Go drain r.Body once and reuse the bytes. If your framework hands you a parsed object, the signature check fails.

No client handy? Every SDK also ships the same logic as a stateless static / module-level helper that takes the API secret as an explicit third argument. The instance method is a thin wrapper around it, so the two forms behave identically; pick whichever fits the call site (Lambdas, edge functions, queue consumers, tests).

// JavaScript (getstream-node)
import { Webhook } from "@getstream/node";
const event = Webhook.verifyAndParseWebhook(rawBody, signature, secret);
# Python (getstream)
from getstream import webhook
event = webhook.verify_and_parse_webhook(body, signature, secret)
# Ruby (getstream_ruby): static helper exposed under the StreamChat::Webhook module
event = StreamChat::Webhook.verify_and_parse_webhook(body, signature, secret)
// PHP (getstream-php)
$event = \GetStream\Webhook::verifyAndParseWebhook($body, $signature, $secret);
// Go (getstream-go): bytes form
event, err := getstream.VerifyAndParseWebhookBytes(body, signature, secret)

// Or, for net/http handlers, the convenience form that takes the request
// (drains the body and reads X-Signature for you):
//   event, err := getstream.VerifyAndParseWebhook(r, secret)
// C# (getstream-dotnet)
var ev = GetStream.Webhook.VerifyAndParseWebhook(body, signature, secret);
// Java (getstream-java)
var event = io.getstream.Webhook.verifyAndParseWebhook(body, signature, secret);

Building this without a Stream SDK? Expand the per-language reference implementation below. Language tabs cover JavaScript, Python, Ruby, PHP, Go, Java and C#.

Retries

In case of the request failure Stream attempts to retry a request. The amount of maximum attempts depends on the kind of the error it receives:

  • Response code is 408, 429 or >=500: 3 attempts
  • Network error: 2 attempts
  • Request timeout: 3 attempts

The timeout of one request is 6 seconds, and the request with all retries cannot exceed the duration of 15 seconds.

When delivery fails after all retry attempts, event failover can persist the failed event to a storage backend you control.

Payload Compression

Enable gzip compression for hook payloads with enable_hook_payload_compression. Compressed payloads are typically 70-90% smaller and the decompression cost is negligible. HTTP webhooks get a Content-Encoding: gzip header; SQS and SNS messages are gzipped and base64-wrapped (because both transports are UTF-8 only). The verifyAndParseWebhook helper (HTTP) and parseSqs / parseSns (SQS/SNS, no app-level HMAC) detect the encoding from the body bytes, so the same handler code works whether or not compression is on, and stays correct even when middleware (Rails, Django, Laravel, Phoenix) auto-decompresses the request.

Apps created after May 7, 2026 have enable_hook_payload_compression set to true by default. Your handlers will receive compressed payloads out of the box, so make sure they call verifyAndParseWebhook on HTTP traffic and parse_sqs / parse_sns on queue/topic deliveries (or equivalent decode + parse_event primitives) before going live. Apps created before that date stay opt-in; run the snippet below to turn compression on.

Enabling compression

await client.updateAppSettings({
  enable_hook_payload_compression: true,
});

The flag applies to every transport: HTTP webhooks, SQS and SNS. It also covers the event failover hook and chat's Before Message Send hook.

Before enabling compression in production

  • Use a current SDK: verifyAndParseWebhook for HTTP (decompress + verify_signature + typed event) and parse_sqs / parse_sns for SQS/SNS (decode + typed event, no app-level HMAC). All three handle uncompressed, gzipped, and base64+gzipped payloads without caller-side branching.
  • Without an SDK, your handler must accept Content-Encoding: gzip and gzip-decompress the body; for SQS/SNS, base64-decode then gzip-decompress (or detect via the gzip magic bytes 1f 8b, per RFC 1952).
  • Verify HMAC on the uncompressed bytes, never on the gzipped or base64-wrapped envelope.
  • Small payloads stay uncompressed to avoid envelope overhead, even with the flag on. The composite helpers handle both cases transparently.

SQS

Stream can send payloads of all events from your application to an Amazon SQS queue you own.

An application with a lot of users generates a lot of events. With a standard webhook configuration, events are posted to your server and can overwhelm unprepared servers during high-use periods. While the server is out, it will not be able to receive webhooks and will fail to process them. One way to avoid this issue is to use Stream's support for sending webhooks to Amazon SQS.

SQS removes the chance of losing data by providing a large, scalable bucket that holds events generated by Stream in a queue for your server. The complete list of supported events is identical to those sent through webhooks.

Authentication

There are 2 ways to configure authentication on your SQS queue:

  1. By providing a key and secret

  2. Or by having Stream's AWS account assume a role on your SQS queue. With this option you omit the key and secret, but instead you set up a resource-based policy to grant Stream SendMessage permission on your SQS queue. The following policy needs to be attached to your queue (replace the value of Resource with the fully qualified ARN of your queue):

{
  "Sid": "AllowStreamProdAccount",
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::185583345998:root"
  },
  "Action": "SQS:SendMessage",
  "Resource": "arn:aws:sqs:us-west-2:1111111111:customer-sqs-for-stream"
}

To configure an SQS queue, use the event_hooks array and the Update App Settings method:

// Note: Any previously existing hooks not included in event_hooks array will be deleted.
// Get current settings first to preserve your existing configuration.

// STEP 1: Get current app settings to preserve existing hooks
const response = await client.getAppSettings();
console.log("Current event hooks:", response.event_hooks);

// STEP 2: Add SQS hook while preserving existing hooks
const existingHooks = response.event_hooks || [];
const newSQSHook = {
  enabled: true,
  hook_type: "sqs",
  sqs_queue_url: "https://sqs.us-east-1.amazonaws.com/123456789012/MyQueue",
  sqs_region: "us-east-1",
  sqs_auth_type: "keys", // or "resource" for role-based auth
  sqs_key: "yourkey",
  sqs_secret: "yoursecret",
  event_types: [], // empty array = all events
};

// STEP 3: Update with complete array including existing hooks
await client.updateAppSettings({
  event_hooks: [...existingHooks, newSQSHook],
});

// Test the SQS connection
await client.testSQSSettings();

Configuration Options

The following options are available when configuring an SQS event hook:

OptionTypeDescriptionRequired
idstringUnique identifier for the event hookNo. If empty, it will generate an ID.
enabledbooleanBoolean flag to enable/disable the hookYes
hook_typestringMust be set to "sqs"Yes
sqs_queue_urlstringThe AWS SQS queue URLYes
sqs_regionstringThe AWS region where the SQS queue is located (e.g., "us-east-1")Yes
sqs_auth_typestringAuthentication type: "keys" for access key/secret or "resource" for role-based authYes
sqs_keystringAWS access key ID (required if auth_type is "keys")Yes if using key auth
sqs_secretstringAWS secret access key (required if auth_type is "keys")Yes if using key auth
event_typesarrayArray of event types this hook should handleNo. Not provided or empty array means subscribe to all existing and future events.

SQS Permissions

Stream needs the right permissions on your SQS queue to be able to send events to it. If updates are not showing up in your queue add the following permission policy to the queue:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1459523779000",
      "Effect": "Allow",
      "Action": [
        "sqs:GetQueueUrl",
        "sqs:SendMessage",
        "sqs:SendMessageBatch",
        "sqs:GetQueueAttributes"
      ],
      "Resource": ["arn:aws:sqs:region:acc_id:queue_name"]
    }
  ]
}

Here's an example list of messages read from your SQS queue:

Reading messages from SQS

SQS honours the same enable_hook_payload_compression flag (see Payload Compression). When compression is on, the message body is gzipped + base64-encoded (SQS only accepts UTF-8) and the producer sets these message attributes:

{
  "content_encoding": "gzip",
  "content_type": "application/json",
  "payload_encoding": "base64"
}

Call parseSqs on your Stream client with the SQS Body string. It reverses the base64 + gzip envelope and returns a typed event (with an UnknownEvent fallback), the same shape verifyAndParseWebhook returns for HTTP. The same call works whether or not compression is on (encoding is detected from the body bytes, so the content_encoding / payload_encoding attributes are only a hint).

No X-Signature on SQS. Stream does not ship an HMAC signature on SQS deliveries. The transport is authenticated end-to-end: the queue is gated by IAM, so only your account can read it, and only Stream's account can write to it.

// message is the SQS Message object you received from ReceiveMessageCommand
const event = client.parseSqs(message.Body);
// event.type, event.user, ...

parse_sqs takes only the message body. No HMAC is involved; use your API secret only for other Stream API calls, not for parsing SQS payloads. The same decode + parse logic is exposed as a static / module-level parse_sqs (see Verifying and Parsing Events for per-language imports); use it in workers that don't keep a Stream client around.

Building this without a Stream SDK? Expand the per-language reference implementation below.

SQS Best practices and Assumptions

  • Set the maximum message size set to 256 KB.

Messages bigger than the maximum message size will be dropped.

  • Set up a dead-letter queue for your main queue.

This queue will hold the messages that couldn't be processed successfully and is useful for debugging your application.

  • Set up alerts in case the size of the queue is growing too fast.

SNS

Stream can send payloads of all events from your application to an Amazon SNS topic you own. SNS provides a large, scalable message exchange that delivers events generated by Stream to as many consumers as you like. The complete list of supported events is identical to those sent through webhooks.

Authentication

There are 2 ways to configure authentication on your SNS topic:

  1. By providing a key and secret

  2. Or by having Stream's AWS account assume a role on your SNS topic. With this option you omit the key and secret, but instead you set up a resource-based policy to grant Stream Publish permission on your SNS topic. The following policy needs to be attached to your topic (replace the value of Resource with the fully qualified ARN of your topic):

{
  "Sid": "AllowStreamProdAccount",
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::185583345998:root"
  },
  "Action": "SNS:Publish",
  "Resource": "arn:aws:sns:us-west-2:1111111111:customer-sns-topic"
}

To configure an SNS topic, use the event_hooks array and the Update App Settings method:

// Note: Any previously existing hooks not included in event_hooks array will be deleted.
// Get current settings first to preserve your existing configuration.

// STEP 1: Get current app settings to preserve existing hooks
const response = await client.getAppSettings();
console.log("Current event hooks:", response.event_hooks);

// STEP 2: Add SNS hook while preserving existing hooks
const existingHooks = response.event_hooks || [];
const newSNSHook = {
  enabled: true,
  hook_type: "sns",
  sns_topic_arn: "arn:aws:sns:us-east-1:123456789012:sns-topic",
  sns_region: "us-east-1",
  sns_auth_type: "keys", // or "resource" for role-based auth
  sns_key: "yourkey",
  sns_secret: "yoursecret",
  event_types: [], // empty array = all events
};

// STEP 3: Update with complete array including existing hooks
await client.updateAppSettings({
  event_hooks: [...existingHooks, newSNSHook],
});

// Test the SNS connection
await client.testSNSSettings({
  sns_topic_arn: "arn:aws:sns:us-east-1:123456789012:sns-topic",
  sns_key: "yourkey",
  sns_secret: "yoursecret",
});

Configuration Options

The following options are available when configuring an SNS event hook:

OptionTypeDescriptionRequired
idstringUnique identifier for the event hookNo. If empty, it will generate an ID.
enabledbooleanBoolean flag to enable/disable the hookYes
hook_typestringMust be set to "sns"Yes
sns_topic_arnstringThe AWS SNS topic ARNYes
sns_regionstringThe AWS region where the SNS topic is located (e.g., "us-east-1")Yes
sns_auth_typestringAuthentication type: "keys" for access key/secret or "resource" for role-based authYes
sns_keystringAWS access key ID (required if auth_type is "keys")Yes if using key auth
sns_secretstringAWS secret access key (required if auth_type is "keys")Yes if using key auth
event_typesarrayArray of event types this hook should handleNo. Not provided or empty array means subscribe to all existing and future events.

Reading notifications from SNS

SNS honours the same enable_hook_payload_compression flag (see Payload Compression). When compression is on, the notification Message is gzipped + base64-encoded (SNS only accepts UTF-8) and the producer sets the same message attributes as SQS.

Call parseSns on your Stream client with the notification body (either the raw envelope JSON string or the pre-extracted Message field). It unwraps the SNS envelope when needed, reverses the base64 + gzip payload, and returns a typed event. The return shape matches verifyAndParseWebhook sans verification. The same call works whether or not compression is on, and whether the topic is delivered over HTTP or via an SQS subscription.

No Stream X-Signature on SNS. Stream does not ship an app-level HMAC on SNS payloads. SNS itself is authenticated with AWS signatures (SigningCertURL / Signature) when you subscribe over HTTPS.

const event = client.parseSns(notification.Message);
// event.type, event.user, ...

parse_sns takes only the notification body string. No HMAC is involved; use your API secret only for other Stream API calls. The same unwrap + decode + parse logic is exposed as a static / module-level parse_sns (see Verifying and Parsing Events for per-language imports).

Building this without a Stream SDK? Expand the per-language reference implementation below.

SNS Best practices and Assumptions

  • Set the maximum message size set to 256 KB.

Messages bigger than the maximum message size will be dropped.

Event Failover

When event delivery fails after all retry attempts, Stream can automatically persist the failed event to a storage backend you control. This ensures no events are lost during outages in your endpoint.

Currently, Google Cloud Storage (GCS) is supported as a failover storage backend.

How it Works

  1. Stream attempts to deliver an event to your endpoint
  2. If all delivery retries are exhausted, the event is written to your configured GCS bucket
  3. The event is stored as a JSON file containing the full event payload, metadata about the failure, and the original endpoint URL

You can then process these failed events at your own pace by reading them from GCS.

Configuration

To enable failover, add a failover_config to your event hook:

await client.updateAppSettings({
  event_hooks: [
    {
      enabled: true,
      hook_type: "webhook",
      webhook_url: "https://example.com/webhooks/stream",
      event_types: ["message.new"],
      failover_config: {
        type: "gcs",
        gcs_bucket: "my-failover-bucket",
        gcs_path: "stream/failed-events",
        gcs_credentials: '{"type":"service_account","project_id":"..."}',
      },
    },
  ],
});

GCS credentials are validated when you save the configuration. Make sure the service account JSON key is valid and has write access to the specified bucket before updating your app settings.

Failover is currently supported for webhook hooks. Support for SQS and SNS hooks is planned.

Configuration Options

OptionTypeDescriptionRequired
typestringStorage backend type. Currently only "gcs" is supportedYes
gcs_bucketstringThe name of your GCS bucketYes
gcs_credentialsstringGCS service account JSON key as a stringYes
gcs_pathstringOptional prefix for the object path inside the bucketNo

GCS Permissions

The service account used in gcs_credentials needs the following permissions on the target bucket:

  • storage.objects.create
  • storage.objects.get

The simplest way is to grant the Storage Object Creator (roles/storage.objectCreator) role to the service account on the bucket.

Storage Format

Failed events are stored as JSON files in your GCS bucket with the following path structure:

{gcs_path}/{yyyy}/{mm}/{dd}/{timestamp}-{event_type}-{hook_id}.json

For example:

stream/failed-events/2026/04/03/1743667200-message.new-a1b2c3d4.json

Each file contains a JSON envelope with the following fields:

FieldDescription
original_hook_idThe ID of the event hook that failed
original_webhook_urlThe endpoint URL that was unreachable
event_typeThe type of event that failed to deliver
error_messageThe error returned by the last delivery attempt
failed_atISO 8601 timestamp of when the failure was recorded
payloadThe full event payload that would have been delivered

Example envelope:

{
  "original_hook_id": "hook-123",
  "original_webhook_url": "https://example.com/webhooks/stream",
  "event_type": "message.new",
  "error_message": "HTTP 500: Internal Server Error",
  "failed_at": "2026-04-03T12:00:00Z",
  "payload": {
    "type": "message.new",
    "cid": "messaging:general",
    "message": { ... },
    "user": { ... }
  }
}

Event failover honours the same app-level enable_hook_payload_compression flag described under Payload Compression. If you build a consumer that reads failed events from your GCS bucket, feed the payload field through the same verifyAndParseWebhook helper you use for live webhooks (or the manual gunzip_payload + parse_event primitives from the reference implementation) so your code transparently handles both the plain-JSON and the compressed cases.

Disabling Failover

To remove the failover configuration, update the hook without the failover_config field:

await client.updateAppSettings({
  event_hooks: [
    {
      enabled: true,
      hook_type: "webhook",
      webhook_url: "https://example.com/webhooks/stream",
      event_types: [],
      // no failover_config = failover disabled
    },
  ],
});

Request info

Some webhooks contain a field request_info , which holds information about the client that issued the request. This info is intended as an additional signal that you can use for moderation, fraud detection, or other similar purposes.

When configuring the SDK, you may also set an additional x-stream-ext header to be sent with each request. The value of this header is passed along as an ext field in the request_info . You can use this to pass along information that may be useful, such as device information. Refer to the SDK-specific docs on how to set this header.

"request_info": {
 "type": "client",
 "ip": "86.84.2.2",
 "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/117.0",
 "sdk": "stream-chat-react-10.11.0-stream-chat-javascript-client-browser-8.12.1",
 "ext": "device-id=123"
}

For example, in Javascript, you can set the value like this:

client = new StreamChat(apiKey, {
  axiosRequestConfig: {
    headers: {
      "x-stream-ext": "device-id=123",
    },
  },
});

The format of the ext header is up to you and you may leave it blank if you don't need it. The value is passed as-is, so you can use a simple value, comma-separated key-values, or more structured data, such as JSON. Binary data must be encoded as a string, for example using base64 or hex encoding.

Restricting Access to Webhook

If necessary, you can only expose your webhook service to Stream. This is possible by configuring your network (eg. iptables rules) to drop all incoming traffic that is not coming from our API infrastructure.

Below you can find the complete list of egress IP addresses that our webhook infrastructure uses. Such list is static and is not changing over time.

RegionIP addresses
us-east4 (US-East)34.225.10.29/32
34.198.125.61/32
52.22.78.160/32
3.215.161.238/32
34.181.149.154/32
34.145.214.228/32
us-east5 (Ohio)3.14.163.216/32
3.15.245.3/32
3.141.116.179/32
34.186.254.218/32
34.186.255.37/32
us-west1 (Oregon)52.25.165.25/32
44.237.58.11/32
52.10.213.81/32
8.229.163.173/32
136.117.241.8/32
northamerica-northeast1 (Canada)35.183.141.98/32
52.60.71.231/32
3.97.253.35/32
34.19.168.136/32
34.19.229.75/32
europe-west4 (EU-West)52.212.14.212/32
52.17.43.232/32
34.241.110.177/32
35.204.6.219/32
34.158.68.88/32
europe-west2 (London)34.153.181.194/32
34.142.62.7/32
europe-west334.179.201.229/32
35.242.238.42/32
asia-south1 (Mumbai)65.1.48.87/32
15.206.221.25/32
13.233.48.78/32
34.93.113.218/32
34.47.139.79/32
asia-southeast1 (Singapore)13.229.11.158/32
52.74.225.150/32
52.76.180.70/32
35.187.232.235/32
35.185.180.233/32
australia-southeast1 (Sydney)54.252.193.245/32
13.55.254.141/32
3.24.48.104/32
34.151.136.126/32
34.116.110.249/32
europe-north234.51.202.72/32
34.51.213.37/32

Product-Specific Hooks

Chat has additional hook types that are configured outside the event_hooks system: Before Message Send for modifying or moderating messages before delivery, Custom Commands for reacting to /slash commands, and pending messages for approval flows. Push delivery to user devices is covered under push notifications.

Previous
GDPR and privacy
Next
Push notifications