# IP Addresses

Source: https://docs.gocardless.com/docs/api-reference/ip-addresses

# IP Addresses

## API traffic

Adding GoCardless IPv4 addresses to an allowlist is **not a supported approach** for securing API traffic. Our IP addresses may change as part of normal operations and must not be relied upon to remain static. This is consistent with best practices for highly-available services.

We recommend relying on the stronger security provided by **Transport Layer Security (TLS)**, which validates GoCardless's identity as part of the normal certificate chain check. Certificate revocation should also be checked for all parts of the chain.

For help implementing this, contact [api@gocardless.com](mailto:api@gocardless.com).

## Webhook traffic

Allowlisting IP addresses for **inbound webhook traffic** is a valid practice. GoCardless publishes the static IP addresses used to send webhooks, and provides at least two weeks' advance notice before any changes.

See the [Webhooks Reference — IP Addresses](/docs/api-reference/webhooks#ip-addresses) section for the current list.

## What's next

  
#### [Webhooks Reference](/docs/api-reference/webhooks)

Delivery guarantees, signing, retries, and the full IP address list.

  
#### [Security Requirements](/docs/api-reference/security-requirements)

TLS and other security requirements for GoCardless integrations.