# IP addresses

Weav sends every webhook from these two IP addresses. If your firewall only lets known addresses in, allow both.

| IP address | Version |
| --- | --- |
| `18.136.62.102` | IPv4 |
| `18.139.176.153` | IPv4 |

## Where they apply

- Every webhook Weav sends: to your webhook URL, your `withdrawals_url`, and a payment's own `webhook_url`.
- Live and test mode alike, first attempts and [retries](https://docs.weavpayments.com/retries).
- Webhooks come only from these addresses. Your calls to Weav are a different direction: send them to `api.weavpayments.com` by name, never by IP.

## Allow both

Add both addresses to your firewall, load balancer or web application firewall rules for your webhook URL. Weav may send from either one, so allowing only one makes some deliveries fail. A webhook your server doesn't answer with `2xx` is retried (see [Retries](https://docs.weavpayments.com/retries)).

> **Warning:** An address isn't proof that a webhook came from Weav. Always [verify the signature](https://docs.weavpayments.com/webhooks/verifying-signatures) too: the allowlist keeps others out of your endpoint, and the signature proves the payload is Weav's and unchanged.

## Changes

Changes to these addresses are announced in the [changelog](https://docs.weavpayments.com/changelog).

This list is for webhooks Weav sends you. To limit where your own API calls come from, use your key's [IP allowlist](https://docs.weavpayments.com/authentication#ip-allowlist).