> ## Documentation Index
> Fetch the complete documentation index at: https://docs-provider.voucher.allride.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Network and IP addresses

> Where the API lives and which addresses AllRide connects from.

## API endpoint addresses

| Environment | Host |
| - | - |
| Sandbox | `api.voucher-staging.allride.io` |
| Production | `api.voucher.allride.io` |

The API hosts are served through Cloudflare's global anycast network. They have **no static inbound IP addresses**: the addresses they resolve to belong to Cloudflare and can change at any time. If your outbound firewall or proxy restricts destinations, allow the **hostname** (for example by SNI or in your egress proxy) rather than IP addresses. If you can only filter by address, use Cloudflare's published ranges ([IPv4](https://www.cloudflare.com/ips-v4), [IPv6](https://www.cloudflare.com/ips-v6)); AllRide does not announce changes to them.

The base URLs and the addresses AllRide connects from are returned by the developer reference of each environment and shown on the [developer reference page](https://provider-developers.voucher.allride.io/go/reference):

```bash theme={null}
curl -sS "$VOUCHER_API_BASE_URL/partner/v1/developer-reference" \
  -H "Authorization: Bearer $VOUCHER_API_KEY" | jq '.data | {apiBaseUrl, egressIps}'
```

`egressIps` are the addresses AllRide connects from.

## Addresses we connect from

Webhook deliveries leave from a small set of static egress addresses per environment (`egressIps` above). If your webhook receiver filters inbound traffic, allow them. The receiver must also be publicly resolvable on port 443 or 8443; private, loopback and cloud metadata addresses are refused when you save the endpoint and again at every delivery.

## Change policy

* New egress addresses are announced at least **30 days** before AllRide starts using them.
* Addresses being retired stay in use for at least **30 days** after the announcement.
* The API hosts have no published inbound addresses (see above); only the hostnames are stable.
* Every change is announced by email to your technical contact (`contacts.technicalEmail`) and in a banner on this site, and the developer reference shows the new state.

Allow announced addresses as soon as they are announced, and remove retired ones only after their removal date.

## TLS requirements

* TLS 1.2 or newer with SNI. Plain-HTTP requests to the API host are refused with 403 and never redirected; always use `https://` so that your key is never sent unencrypted.
* The API hosts are proxied by Cloudflare and use a publicly trusted certificate that Cloudflare renews automatically. Do not pin the server certificate or its intermediate.
* The API does not use client certificates: authenticate with your [API key](https://docs-provider.voucher.allride.io/guides/authentication.md) and, optionally, restrict calls to your addresses with the [IP allowlist](https://docs-provider.voucher.allride.io/guides/ip-allowlist.md). The allowlist sees the address your request reaches Cloudflare from.
* Webhooks are sent with TLS 1.2 or newer and certificate validation; your receiver needs a certificate from a public CA. Redirects are not followed.

## Related

* [IP allowlist](https://docs-provider.voucher.allride.io/guides/ip-allowlist.md)
* [Webhooks](https://docs-provider.voucher.allride.io/webhooks/overview.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.