If your systems restrict inbound traffic, allowlist Banxa's outbound IP addresses to receive webhooks.
Prefer signature verification
IP allowlisting is optional. The recommended way to authenticate webhooks is HMAC signature verification, which works regardless of source IP. See Webhooks.
| Environment | Outbound IPs |
|---|---|
| Production | 54.79.50.123, 13.236.103.112 |
| Sandbox | 13.55.238.18, 13.237.24.211 |
- Order webhooks and KYC webhooks are sent by separate systems and may originate from different IPs, even though both are delivered to the same webhook URL you configure. Allowlist all IPs for the relevant environment.
- Any change to these IPs will be announced in the Changelog before rotation.