Skip to main content
IP whitelisting is a mandatory security layer in FastFlowPe’s authentication model. Every X-API-Key your account generates is bound to the IP addresses you register. FastFlowPe validates the source IP of every incoming request and rejects any call that does not originate from a recognized address — regardless of whether the key itself is valid. This means that even if an X-API-Key is leaked or intercepted, it cannot be used from an attacker’s server. Only requests from your registered IPs will be accepted.

​
How It Works

Each merchant account supports up to two registered IP addresses:
  • Primary IP — Required. The main server IP from which your integration makes API calls.
  • Secondary IP — Optional. A backup or secondary server IP, useful for redundancy or failover setups.
FastFlowPe checks the source IP of every API request against these registered values. Requests from any other address are rejected immediately, before any business logic is evaluated.
You must register at least a Primary IP before you can successfully make any authenticated API call. API requests from unregistered IPs are rejected even when a valid, unexpired X-API-Key is provided.

​
How to Whitelist Your IP Addresses

1

Log In to the Merchant Dashboard

Go to https://go.fastflowpe.com/ and sign in with your registered email address and password.
2

Navigate to IP Whitelisting

From the main navigation, go to Settings → API → IP Whitelisting. You will see input fields for your Primary and Secondary IP addresses.
3

Enter Your Primary IP Address

Type the public IP address of your primary server — the one your integration will make API calls from. Double-check this value carefully before proceeding.
4

Enter Your Secondary IP Address (Optional)

If you have a backup or secondary server, enter its IP address in the Secondary IP field. You can leave this blank if you only need one address.
5

Submit and Confirm

Click the submit button to save your IP addresses. FastFlowPe immediately applies the whitelist to your account. All future API requests are validated against these values.
Once your IP addresses are submitted, they cannot be changed. Confirm that both values are correct before saving. If you enter an incorrect IP or need to update your addresses in the future, contact FastFlowPe Support.

​
Choosing Your IP Configuration

You have flexibility in how many IPs you register:
Use your server’s static public IP address, not a private or internal network address. Dynamic IPs that change on restart or reconnect will cause your API calls to fail once the IP changes. If your infrastructure uses dynamic addressing, set up a static IP or a NAT gateway before registering.

​
What IP Whitelisting Does and Does Not Protect

IP whitelisting provides strong protection against misuse of a leaked X-API-Key, but it is one part of a broader security posture — not a complete substitute for protecting your credentials.
IP whitelisting prevents unauthorized use of your X-API-Keys from unknown servers. It does not protect your Client ID or Client Secret. Secure all three values independently: keep your credentials private, rotate X-API-Keys regularly, and ensure only trusted servers hold registered IP addresses.