> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://developers.brevo.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developers.brevo.com/_mcp/server.

If your notify URL supports authentication methods, define them when creating the webhook instance.

## Whitelisting our webhook IPs

This is the most basic way to ensure your resource is only accessible from our IP ranges. Add the range to your API configuration. CIDR ranges are listed [**here**](https://help.brevo.com/hc/en-us/articles/208848409).

## Username and password authentication

The username and password are appended to the `url` parameter on the endpoint. The format is `https://username:password@example.com/`. A sample cURL request:

```
curl --location 'https://api.brevo.com/v3/webhooks' \
--header 'content-type: application/json' \
--header 'api-key: xkeysib-{api-key}' \
--data '{
    "description" : "string",
    "url" : "https://username:password@hook.znapi.cc/ix0v9dsy",
    "events" : ["sent"],
    "type" : "transactional"
}'
```

The API key is required by default to authenticate the API endpoint request. The cURL request above creates a webhook for transactional emails using the `sent` event, authenticated by adding the username and password to the URL.

## Bearer token authorization

If your notify URL uses token-based header authentication, define it as follows when creating the webhook object.

```json
curl --location 'https://api.brevo.com/v3/webhooks' \
--header 'content-type: application/json' \
--header 'api-key: xkeysib-{api-key}' \
--data '{
    "description" : "string",
    "url" : "https://example.com/notifyurl3234121232",
    "events" : ["sent"],
    "type" : "transactional"
    "auth":{
             "type":"bearer",
             "token":"client-token"
    }
}'
```

## Cloudflare headers authorization

Cloudflare authorization is handled by adding headers in the [Create/Update a Webhook](/reference/create-webhook) endpoint. You can add any values as request headers. An example cURL request:

```curl

curl --location 'https://api.brevo.com/v3/webhooks' \
--header 'content-type: application/json' \
--header 'api-key: ' \
--data '{
    "description" : "string",
    "url" : "https://example.com/notifyurl3234121232",
    "events" : ["sent"],
    "type" : "transactional",
    "headers":[
          {
              "key":"client-id",
              "value":"1234clientidvalue"
          },
          {
              "key":"client-secret",
              "value":"5678clientsecretvalue"
          }
     ]
}'

```

Send a request to the endpoint with any values as headers; multiple headers are supported. These headers are used for authentication when a webhook event is triggered to the URL.