Official Asaas IPs

Asaas Webhooks use official IPs to communicate with external applications.

Use these IPs in Firewall, WAF, Security Group, proxy, or other rules that restrict which origins can access your Webhook endpoint.

When to use

Configure an allowlist when your infrastructure:

• uses a Firewall, Cloudflare, or AWS WAF;
• restricts access by source IP;
• only allows previously authorized origins;
• protects the Webhook endpoint with network rules.

Official Production IPs

Currently, Asaas Webhooks in Production may be sent from the following IPs:

• 52.67.12.206
• 18.230.8.159
• 54.94.136.112
• 54.94.183.101

Configure the allowlist

Add the official IPs at the layer that controls access to the endpoint, such as:

• Cloudflare;
• AWS Security Groups;
• Azure NSG;
• corporate Firewall;
• reverse proxy;
• load balancer.

If the endpoint is dedicated to receiving Asaas Webhooks, an access rule can follow this logic:

Allow:
52.67.12.206
18.230.8.159
54.94.136.112
54.94.183.101

Block:
All other origins

The specific configuration depends on the infrastructure used by your application.

If you use Cloudflare, see CloudFlare Firewall Blocking.

Sandbox environment

There may be additional IPs in the Sandbox environment.

If Webhooks return 403 Forbidden in Sandbox, check the Firewall or Cloudflare events to identify the blocked address and adjust the access rule.

Do not use the Production list as a guarantee that all Sandbox deliveries will use the same IPs.

How to validate the configuration

After configuring the allowlist:

1. generate or wait for a new event monitored by the Webhook;
2. confirm that the request reached the endpoint;
3. check the Webhook Logs;
4. verify that there are no 403 responses caused by the Firewall or WAF.

When the IPs are correctly allowed, Asaas requests can reach the endpoint and should not be blocked by origin-based rules.

If you keep receiving 403, see Error 403 (Forbidden) to investigate other causes, such as WAF, User-Agent, authentication, or internal validations.

If the failures lead to the queue being interrupted, first fix the security rule and then follow the guide How to reactivate an interrupted queue.

Next steps

• Configure the Firewall in CloudFlare
• Investigate Error 403 (Forbidden)
• Check the Webhook Logs
• Understand the Paused queue behavior
• Reactivate an interrupted queue