WishList Member Security Notice – Set Your Recurly Notification Username and Password

After updating to WishList Member 3.33.0 or higher, you may see a “WishList Member Security Notice – Recurly” on your dashboard that reads: “Recurly push notifications cannot be securely verified until you set a notification username and password. WishList Member is accepting them without verification until you do. If you are not using this integration, deactivating it will also dismiss this notice.”

This article explains why the notice appears and how to resolve it.

Why You're Seeing This Notice

Recurly sends push notifications to your site to report events such as renewals, cancellations, and expirations. Recurly does not sign these notifications, so WishList Member now protects the notification endpoint with a username and password (HTTP Basic authentication).

When a push notification arrives, WishList Member checks that it carries the username and password you configured. If no notification username and password are saved, WishList Member cannot verify that the notification genuinely came from your Recurly account, so it shows this notice.

What This Means for Your Payments

Your site keeps working in the meantime. Recurly events such as renewals and cancellations are still being processed, so your members' access continues to update.

The notice is about verification, not interruption. Until you set a notification username and password, WishList Member accepts Recurly notifications without confirming they came from your account. Setting the credentials restores that verification.

The notice stays in place until the credentials are set, and it cannot be dismissed. That is intentional: it is a reminder to complete a one-time setup step. Since this step affects how your payments are verified, we encourage you to take care of it soon. Once the credentials are set, the notice clears on its own.

How to Resolve It

Not using Recurly? If you don't use Recurly to accept payments on the site, you don't need to set notification credentials. You can deactivate the Recurly integration in the Setup > Integrations > Payment Providers section in WishList Member, and the notice will dismiss. The steps below are for if you do use the Recurly integration in WishList Member.

You will set the credentials in two places so they match: in WishList Member, and in your Recurly account.

1. In WishList Member, go to the Setup > Integrations > Payment Providers section and open the Recurly configuration. You can also click “Configure Recurly” in the notice.
2. Enter a value in the Push Notification Username and Push Notification Password fields. You can choose any values you like; treat the password like any other credential and keep it private.
3. Save your settings.
4. In your Recurly account, go to Integrations > Webhooks and open your webhook endpoint (the one using your WishList Member Push Notification URL). Enter the same values in the HTTP Auth Username and HTTP Auth Password fields and save. Recurly sends these as HTTP Basic authentication with each push notification, so they must match exactly what you saved in WishList Member.

Once you save the notification username and password in WishList Member, the notice clears on its own. (You don't need to wait for a Recurly event to come through.)

Still Seeing the Notice?

If the notice is still showing after you have set the credentials, the most common cause is that the username and password configured in Recurly do not exactly match the ones saved in WishList Member. Please confirm both sides match, with no extra spaces. The notice clears on its own once the credentials are saved in WishList Member.