IP Addresses#
API traffic#
Adding GoCardless IPv4 addresses to an allowlist is not a supported approach for securing API traffic. Our IP addresses may change as part of normal operations and must not be relied upon to remain static. This is consistent with best practices for highly-available services.
We recommend relying on the stronger security provided by Transport Layer Security (TLS), which validates GoCardless's identity as part of the normal certificate chain check. Certificate revocation should also be checked for all parts of the chain.
For help implementing this, contact api@gocardless.com.
Webhook traffic#
Allowlisting IP addresses for inbound webhook traffic is a valid practice. GoCardless publishes the static IP addresses used to send webhooks, and provides at least two weeks' advance notice before any changes.
See the Webhooks Reference — IP Addresses section for the current list.