IP allowlist

Let your live API keys work only from your own servers. A key that leaks into a log, a repository or a laptop is then useless anywhere else.

Live keys only

Test keys are not limited by it, so your laptop and CI work with them from anywhere (Test mode). With no addresses on the list, live keys work from anywhere too.

Add your servers

1. Find your servers’ public addresses. The address the internet sees: your NAT gateway’s or load balancer’s outbound IP, not the server’s private one. On each server that calls the API:

   curl -4 https://ifconfig.me; curl -6 https://ifconfig.me

2. Add them in the merchant portal. Open the account, then Settings › Developers › IP allowlist › Add IP. One address or a range, with a label so you know later whose it is.

3. Call the API from each server. Within a second of adding, a live call from there goes through; a call from anywhere else gets 403 with the code ip_not_allowed.

What you can add

Addresses	IPv4 and IPv6: one address (203.0.113.7, 2001:db8::7) or a range in CIDR (203.0.113.0/28, 2001:db8:4f00::/48). Our API answers on IPv6 too, so add your IPv6 if your servers have one.
Range size	At most /24 for IPv4 and /48 for IPv6. Wider ranges would let in other people’s servers.
Public only	Private and reserved ranges (10.0.0.0/8, 192.168.0.0/16, ::1 …) are refused: calls never come from there.
How many	Up to 50 per account. Out of room? Use a range.
Scope	The account: every live key of it, now and later.

When a call is refused

A live key used from any other address gets 403 with the code ip_not_allowed. The message names the address the call came from, so you know what to add.

Response · 403 Forbidden

HTTP/1.1 403 Forbidden

{"error": {"type": "invalid_request_error", "code": "ip_not_allowed",
  "message": "This API key cannot be used from 198.51.100.7. Add the IP to the allowlist of the account.", …}}

Your developers get an email at most once an hour per address. The portal’s IP allowlist page also lists Recently blocked addresses from the last 7 days, each with an Add button: moved to new servers, that list is the quickest way back.

Who can change it

Admins and developers of the account, in the merchant portal; operators do not see the page. Each change asks you to confirm it’s you, takes effect within a second, and is emailed to the account’s admins. Removing the last address asks to confirm that live keys will then work from any address. Our team can change the list for you too: the account’s admins get the same email, and an entry our team added shows NovaroPay as who added it.

And the other way: webhooks

This list is about calls you make to us. To let our webhooks in through your firewall, allow our IP addresses and check every webhook’s signature.