# Secure communications between rasa core and custom action server

**URL:** <https://forum.rasa.com/t/secure-communications-between-rasa-core-and-custom-action-server/40823>\
**Category:** Rasa Open Source\
**Created:** [March 3, 2021, 11:37am UTC](https://forum.rasa.com/t/secure-communications-between-rasa-core-and-custom-action-server/40823 "2021-03-03T11:37:18Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![chascoppard](https://avatars.discourse-cdn.com/v4/letter/c/5daacb/32.png) [@chascoppard](https://forum.rasa.com/u/chascoppard)\
**Post date:** [March 3, 2021, 11:37am UTC](https://forum.rasa.com/t/secure-communications-between-rasa-core-and-custom-action-server/40823/1 "2021-03-03T11:37:19Z")

</div>

Hi,

We have a multi-tenant API. Clients are identified and secured by client SSL certificates. User identification is via JWT tokens.

We are implementing a Rasa chatbot for one of our clients. We want to add a webhook endpoint to our API to act as the custom action server.

Therefore can we:

1. apply a client certificate to the request between rasa core and our action server.
2. pass a JWT token between rasa core and our action server to securely identify the user.

It is not clear if this is possible without modifying the rasa source.