Skip to main content
IP whitelisting restricts bluSwap API access to a defined list of server IP addresses. Even a valid x-api-key will be rejected if the request originates from an IP that is not on your whitelist.

​
Why enable IP whitelisting

IP whitelisting adds a second layer of defense on top of your x-api-key. If a key is ever leaked, attackers still cannot use it from their own servers.
IP whitelisting protects your x-api-key from misuse. It does not protect your Client ID and Client Secret. Keep those secured independently.

​
Register your server IPs

Add your production server IPs from the merchant dashboard:
1

Sign in to the dashboard

Go to your bluSwap merchant dashboard and log in.
2

Open Settings

Navigate to Settings → IP & Secret key → IP Whitelisting.
3

Add allowed IPs

Enter each server’s public IPv4 address. Use one address per entry; CIDR ranges are not supported.
4

Save and test

Save your changes and issue a test API call from each server to confirm it succeeds.

​
Best practices

  • Whitelist only the servers that make outbound bluSwap API calls, not developer machines.
  • Route API traffic through a fixed egress IP (such as a NAT gateway) when running in cloud environments with dynamic instance IPs.
  • Review the whitelist regularly and remove IPs for decommissioned servers.

​
Errors

If a request comes from an IP that is not whitelisted, the API returns:
Response status: 401 Unauthorized. Verify the calling server’s public IP and confirm it is registered in the dashboard.