Allow requests from the documented XPay server addresses when the merchant firewall, web application firewall, or another network control restricts inbound traffic.
XPay server addresses
Allow these IPv4 addresses:
3.21.132.182
3.132.41.108Apply the allowlist only to the merchant endpoints that must receive XPay traffic. Keep HTTPS, webhook signature verification, and application-level validation enabled; an allowed source address does not replace authentication.
Verify connectivity
- Apply the allowlist in the applicable test environment.
- Trigger an XPay request to the merchant endpoint.
- Confirm that the network control accepts the connection.
- Confirm that the application still rejects an invalid webhook signature.
- Repeat the verification after applying the production network policy.
Troubleshooting
If an expected XPay request does not arrive, check firewall and WAF logs for a blocked source address, confirm that the public endpoint resolves correctly, and verify that HTTPS is available from outside the merchant network.
Do not allow all inbound traffic as a workaround. Contact XPay if the observed source address is not in this list.