Set Up Your Security {#wh-fg-server-security}
=============================================

There are a variety of security options for Webhooks. This section provides an overview of the security options, with links to the instructions for using them.

Mutual Trust
------------

All Webhooks integrations must use mutual trust by adding `Visa Acceptance Solutions` to your allowlist and by trusting the root certificate.  
**Allowlist**  
Add these IP addresses to your allowlist to permit `Visa Acceptance Solutions` to deliver your webhook notifications:

* 198.241.206.21
* 198.241.207.21

**Trusting the Root Certificate**  
Download the *Visa Corporate Root CA - G2* certificate from the Visa Public Key Infrastructure webpage, and add it to your Java keystore: [`https://enroll.visaca.com`](https://enroll.visaca.com "").

API Keys {#wh-fg-server-security_section_ykc_y1p_33c}
-----------------------------------------------------

REST API requests must use API Keys. All Webhooks requests require a shared secret key pair. Requests to create a subscription using OAuth with JWT **also** require a P12 Certificate. For instructions, see [Create REST APIs](https://developer.cybersource.com/docs/cybs/en-us/webhooks/implementation/all/rest/webhooks/webhooks-keys-intro.md "").

Digital Signature Key {#wh-fg-server-security_section_v2j_z1p_33c}
------------------------------------------------------------------

You must create a digital signature key in order for `Visa Acceptance Solutions` to send notifications to your servers. For instructions, see [Create a Digital Signature Key](/docs/vas/en-us/webhooks/implementation/all/rest/webhooks/wh-fg-key-dig-sig-intro.md "").

OAuth and OAuth with JWT {#wh-fg-server-security_section_cm4_sqp_33c}
---------------------------------------------------------------------

In addition to mutual trust, you can also use the OAuth or OAuth with Java Web Token (JWT). You must provide your OAuth credentials and use the appropriate request fields for your security policy. See [(Optional) Provide Your OAuth Credentials](/docs/vas/en-us/webhooks/implementation/all/rest/webhooks/wh-fg-oauth-cred-intro.md "") and [Create a Webhook Subscription](/docs/vas/en-us/webhooks/implementation/all/rest/webhooks/wh-fg-subscribe-intro.md "").

Message-Level Encryption {#wh-fg-server-security_section_yyq_xbp_33c}
---------------------------------------------------------------------

Message-level encryption is required for some products and events. For instructions, see [Message-Level Encryption](/docs/vas/en-us/webhooks/implementation/all/rest/webhooks/wh-fg-mle-intro.md "").