Allow webhooks and API callbacks safely

Start with the exact endpoint

In Security rules, choose the payment-webhook template. Replace /api/webhook with the actual callback path and keep POST if your provider uses it. Add an IP or IPv4 CIDR condition when the provider publishes a stable sending range. All conditions must match.

Cloudhider forwards the request; your application must still validate the provider's signature, timestamp and event identity. A network exception does not authenticate a payment or authorize an application action.

Use the URL whitelist deliberately

The dedicated URL whitelist accepts one path or fragment per line. Legacy contains mode matches a fragment anywhere in the path. Prefix matches the beginning of the path, while exact mode matches the entire path. Matching ignores case and excludes query parameters.

Use a custom rule when you also need HTTP-method, IP or expiry conditions. A short fragment such as api can match many endpoints in legacy mode. Prefer an exact endpoint when that is sufficient.

Set a temporary exception

For a migration or incident, set an expiry on the custom skip-bot-checks rule. Review the local time shown in the editor and save. After expiry, ordinary browser and rate checks resume automatically for requests that no longer match another exception.

Exceptions bypass browser and soft-rate checks. Explicit denials, exploit protection and the hard rate limit remain active. If a request is still blocked, inspect its reason and request ID before expanding the exception.

Verify delivery

Send the provider's normal test event, then inspect the method, path, status and decision in Traffic & events. Open the rule tester from that event to inspect custom-condition matches. The rule tester does not send the callback again, and replaying financial or other state-changing events is outside its scope.