IP access
The address halfin sends webhooks from, and the current state of API-key IP restrictions.
API-key IP restrictions and webhook source-IP filtering protect different directions of traffic. Neither replaces the API key or webhook signature.
API-key restrictions#
A non-empty API-key allowlist is not ready to recommend for hosted integrations. Do not enable it as a security dependency until support confirms source-address enforcement for your deployment. Do not add platform, ingress, or proxy addresses to make rejected requests pass.
The existing key format accepts IPv4, IPv6, and CIDR entries. A refused request can return 403 api_key_ip_forbidden. If that occurs, review the restriction with support instead of repeatedly retrying.
Receiving webhooks#
Every webhook delivery leaves halfin from one source address. It is the same address for live and test.
| Family | Address | Firewall entry |
|---|---|---|
| IPv4 | 149.202.75.81 | 149.202.75.81/32 |
Deliveries are made over IPv4 only, and no forward proxy or CDN sits in the delivery path, so this is the address your receiver observes on the connection. halfin does not send webhooks from an IPv6 address.
Allowlist it as an exact /32 host entry. Do not widen the rule to the surrounding 149.202.75.0/24: the rest of that range is not ours.
A source-address allowlist is optional and does not affect delivery either way. It is a second line of defense and never replaces signature verification: only the signature proves that halfin produced the event. Authenticate each delivery by checking the event ID, timestamp, and exact body bytes, and accept only the events and environment your receiver is configured to handle.
Changes to this address#
A planned change is announced at least seven days before it takes effect, on the changelog. An unplanned replacement, such as an emergency migration, is announced there on the day it takes effect. There is no merchant API endpoint that returns this list; read it from this page.
Protect your integration#
Keep API keys and webhook secrets in your server's secret manager, use least-privilege keys, validate HTTPS certificates, and deduplicate webhook events. Replace exposed credentials promptly. See API keys and webhook secrets.