Restrict webhooks by Adobe IMS authorization and browser origin

Restrict webhooks by Adobe IMS authorization and browser origin

Restrict webhooks by Adobe IMS authorization and browser origin

We’ve added two new security controls for custom webhooks: Allowed Origins (CORS) to restrict browser-based calls to specific domains, and Adobe IMS Bearer token validation so webhooks accept requests only when callers present a valid Adobe IMS access token.

Overview

Custom webhooks can now enforce two common security requirements:

• Allowed Origins (CORS) — Specify which browser origins may invoke the webhook from client-side JavaScript. Requests from other origins are blocked by CORS, preventing untrusted web pages from calling your webhook.
• Adobe IMS authorization — Require requesters to send an Adobe IMS access token in the Authorization header (Bearer <token>). Fusion validates the token before accepting the webhook payload, enabling secure server-to-server or user-scoped calls using Adobe Identity Management.

How to configure Allowed Origins and IMS authorization

1. Open the Add a hook dialog for the webhook you want to create or edit and check Show advanced settings.
2. Under Authorization type, select Adobe IMS (Bearer token) if you want Fusion to validate incoming IMS tokens.
3. In the Allowed origins field, enter the list of origins (for example https://www.example.com, https://app.example.com) that should be permitted to call the webhook from a browser. Use exact scheme + host (+ port when needed).
4. Save the webhook. When IMS is enabled, Fusion will validate the Authorization header and when Allowed origins are set, Fusion will include the appropriate CORS response headers for allowed browser requests.

Behavior and tips

• Allowed Origins implements CORS policy for browser-initiated requests. Non-browser clients (server-to-server) are not subject to CORS; use IMS validation or other auth to secure those calls.
• When IMS authorization is enabled, send the Adobe IMS access token in the Authorization header as Bearer <access_token>. Fusion validates the token before accepting payloads.
• If both controls are used together, browser requests must come from an allowed origin and include a valid IMS token to be accepted.
• Leaving Allowed origins empty results in no browser-origin restriction (default permissive behavior for CORS). Leaving Authorization type unset means Fusion will accept unauthenticated requests (unless other protections are in place).
• Use descriptive webhook names or notes to indicate which environment (dev, staging, prod) or client application each webhook and policy is intended for.

Where to find documentation

Step‑by‑step configuration details and examples are available on Experience League: see Webhooks and HTTP module authentication and CORS settings for usage examples and troubleshooting.

https://experienceleague.adobe.com/en/docs/workfront-fusion/.../webhooks-updated#use-a-webhook-with-adobe-identity-management-system-ims

Need help or want to give feedback?

If you have questions or run into issues, post a comment below, start a thread in the Experience League Community, or contact Adobe Support through the Admin Console Support portal. Your feedback helps us prioritize future enhancements (for example, allowlist management APIs, automated origin validation, or expanded IMS claim checks).