We’re currently setting up Shopify webhooks to send requests to our internal staging servers, which are not publicly exposed. For security reasons, we prefer to whitelist Shopify’s IP address ranges at the network firewall level, rather than relying solely on application-layer validation.
We understand that Shopify’s webhook IPs may change over time, and we’re fine with updating our firewall rules when that happens. Our key requirement is to restrict webhook access to Shopify-only IPs while keeping our staging environment private.
Can Shopify provide an official and up-to-date list of IP ranges used for webhooks? Or is there a recommended approach to securely handle this for non-public environments?
Thanks in advance!