After updating to WishList Member 3.33.0 or higher, you may see a “WishList Member Security Notice – Recurly” on your dashboard that reads: “Recurly push notifications cannot be securely verified until you set a notification username and password. WishList Member is accepting them without verification until you do.” This article explains why the notice appears and how to resolve it.
Why You're Seeing This Notice
Recurly sends push notifications to your site to report events such as renewals, cancellations, and expirations. Recurly does not sign these notifications, so WishList Member now protects the notification endpoint with a username and password (HTTP Basic authentication).
When a push notification arrives, WishList Member checks that it carries the username and password you configured. If no notification username and password are saved, WishList Member cannot verify that the notification genuinely came from your Recurly account, so it shows this notice.
What This Means for Your Payments
Your site keeps working in the meantime. Recurly events such as renewals and cancellations are still being processed, so your members' access continues to update.
The notice is about verification, not interruption. Until you set a notification username and password, WishList Member accepts Recurly notifications without confirming they came from your account. Setting the credentials restores that verification.
The notice stays in place until the credentials are set, and it cannot be dismissed. That is intentional: it is a reminder to complete a one-time setup step. Since this step affects how your payments are verified, we encourage you to take care of it soon. Once the credentials are set and a verified notification is received, the notice clears on its own.
How to Resolve It
You will set the credentials in two places so they match: in WishList Member, and in your Recurly account.
- In WishList Member, go to the Setup > Integrations > Payment Providers section and open the Recurly configuration. You can also click “Configure Recurly” in the notice.
- Enter a notification username and a notification password. You can choose any values you like; treat the password like any other credential and keep it private.
- Save your settings.
- In your Recurly account, go to Integrations > Webhooks and open your webhook endpoint (the one using your WishList Member Push Notification URL). Enter the same values in the HTTP Auth Username and HTTP Auth Password fields and save. Recurly sends these as HTTP Basic authentication with each push notification, so they must match exactly what you saved in WishList Member.
Once WishList Member receives a push notification carrying the matching credentials, the notice clears.
Still Seeing the Notice?
If the notice is still showing after you have set the credentials, the most common cause is that the username and password configured in Recurly do not exactly match the ones saved in WishList Member. Please confirm both sides match, with no extra spaces. The notice clears on its own once WishList Member receives a verified push notification from Recurly.
