> ## Documentation Index
> Fetch the complete documentation index at: https://docs-consumer.voucher.allride.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Network and IP addresses

> The API hostnames, the addresses AllRide connects from, how address changes are announced, and the TLS requirements.

## API endpoint addresses

| Environment | API host |
| - | - |
| Sandbox | `api.voucher-staging.allride.io` |
| Production | `api.voucher.allride.io` |

The API hosts are served through Cloudflare's anycast network. They have **no static inbound IP addresses**: the addresses they resolve to are Cloudflare's and can change at any time. If your network filters outbound traffic, allow the API hosts **by hostname** (for example in your proxy or firewall's FQDN rules). If your firewall can only work with addresses, allow Cloudflare's published ranges ([IPv4](https://www.cloudflare.com/ips-v4), [IPv6](https://www.cloudflare.com/ips-v6)). Both hosts resolve to IPv4 and IPv6. Do not derive addresses from a DNS lookup.

The base URL and the addresses AllRide connects from are returned by the developer reference of each environment and shown on the [developer reference page](https://consumer-developers.voucher.allride.io/go/reference):

```bash theme={null}
curl -sS "$VOUCHER_API_BASE_URL/partner/v1/developer-reference" \
  -H "Authorization: Bearer $VOUCHER_API_KEY" | jq '.data | {apiBaseUrl, egressIps}'
```

`egressIps` lists the current addresses AllRide connects from ([Get developer reference information](https://docs-consumer.voucher.allride.io/api-reference/partner-developer-reference-get.md)), including the two disaster-recovery addresses. It is a plain list without status or dates: it holds the addresses that are in use (`active` or `retiring`), and an `announced` address joins it only on its `since` date. Take announced addresses from the announcement email or the [egress address tables](#egress-address-tables). Do not derive the addresses from a DNS lookup.

## Addresses we connect from

AllRide connects to your systems from **four** static egress IPv4 addresses per environment (`egressIps` above): two that are in use, and two disaster-recovery addresses that carry traffic only after a failover to the second region. Allow all four, so that deliveries keep arriving after a failover. They are used for:

* **Webhook deliveries** to your webhook endpoints ([Webhooks](https://docs-consumer.voucher.allride.io/webhooks/overview.md)).
* **OTP emails** sent through your SMTP server, if you use [email OTP links](https://docs-consumer.voucher.allride.io/consumer/email-otp-links.md).

If your webhook receiver or SMTP server filters inbound traffic, allow all egress addresses of the environment you use, including the disaster-recovery addresses.

### Egress address tables

The tables for sandbox and production, with each address's status (`active`: in use; `announced`: used from its `since` date; `retiring`: still in use until its `removeAfter` date), are published here from AllRide's infrastructure configuration. Status and dates are shown only in these tables; the developer reference lists the current set.

> [!NOTE]
>
> The tables appear here after the first network sync. Until then, `egressIps` in the developer reference lists the current addresses, and every change is announced by email to your technical contact.

## Change policy

* New egress addresses are announced at least **30 days** before AllRide starts using them.
* Addresses being retired stay in use for at least **30 days** after the announcement.
* The API hosts have no published inbound addresses (see above); only the hostnames are stable.
* Every change is announced by email to your technical contact (`contacts.technicalEmail`) and in a banner on this site, and the developer reference shows the new state.

Allow announced addresses as soon as they are announced, and remove retired ones only after their removal date (`removeAfter` in the [egress address tables](#egress-address-tables)); the announcement email gives the same dates.

## TLS requirements

* The API accepts only HTTPS with **TLS 1.2 or newer** and requires SNI. Plain-HTTP requests to the API host are refused with 403 and never redirected; always use `https://` so that your key is never sent unencrypted.
* The API hosts are served through Cloudflare and present a publicly trusted certificate that is managed and renewed automatically. **Do not pin** the server certificate or its intermediate: validate it against your system trust store.
* Webhook deliveries connect to your endpoint over TLS 1.2 or newer and validate your server certificate against its hostname. Self-signed server certificates are not accepted.
* The API authenticates your client with its API key over HTTPS; client certificates (mutual TLS) are not used. To restrict where your keys work from, use the [IP allowlist](https://docs-consumer.voucher.allride.io/guides/ip-allowlist.md).

## Related

* [IP allowlist](https://docs-consumer.voucher.allride.io/guides/ip-allowlist.md)
* [Authentication](https://docs-consumer.voucher.allride.io/guides/authentication.md)
* [Webhooks](https://docs-consumer.voucher.allride.io/webhooks/overview.md)
* [Sandbox and production](https://docs-consumer.voucher.allride.io/guides/environments.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.