> ## Documentation Index
> Fetch the complete documentation index at: https://developer.sodacards.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhook IP addresses

> The address our webhook deliveries come from, and why it does not replace signature verification.

Every webhook delivery to your endpoint originates from a single, stable address:

<Info>
  **`164.90.161.33`**
</Info>

If your endpoint sits behind an IP allowlist or firewall, allow this address so deliveries reach you.

<Warning>
  An IP allowlist is a coarse network filter, not authentication. It does **not** prove a request came
  from us: source addresses can be spoofed, and shared infrastructure can send from an allowed range.
  Always [verify the signature](/webhooks) on every event, whether or not you also filter by IP. The IP
  allowlist complements the signature; it never replaces it.
</Warning>

This address may change as our infrastructure evolves. When it does, we announce it on the
[changelog](/changelog) with advance notice, so treat it as configuration, not a constant to hardcode
beyond your firewall rules.