Skip to main content

How the live IP allowlist is checked, and webhook endpoints Reeds turns off

Reeds Engineering
Reeds Engineering
Developer platform

How the API checks the live IP allowlist announced on 28 October. It is optional, and off while your list is empty.

What the API checks​

  • With at least one address on your list, POST /oauth/token with a live client id from any other address returns 400 with { "error": "unauthorized_client" }, and the secret isn't checked. Every /shipping/v1/* call with a live token from any other address returns 403 IP_NOT_ALLOWED, naming the address Reeds saw, before anything runs.
  • Test credentials and test tokens are never checked.
  • Reeds reads your address from its own proxy, never from an X-Forwarded-For header you send. An IPv4 address that reaches Reeds as IPv6 (::ffff:41.58.10.5) is matched as the IPv4 address.
  • A change takes effect within a minute.
  • Refused calls are in the dashboard's API request log, and the addresses they came from are in the allowlist card's Recent IP addresses, marked as refused.

Changing the list​

  • Adding and removing an address each need a 6-digit code from your authenticator app (recovery codes aren't accepted), so turn on two-factor authentication first. After 5 wrong codes in 15 minutes, that person's changes are paused for up to 15 minutes.
  • The account's Owners get an email for every change: who made it, when, from which IP address, and whether it turned the list on or off.
  • Removing an address always works, even while adding is paused.

Webhook endpoints Reeds turns off​

Reeds can turn a webhook endpoint off, for example while investigating a problem with it. Your audit log says why. Nothing is sent to it then, not even a resend or a test event, and saving the URL again doesn't turn it back on; contact support. While it is off, POST /webhooks/test returns 409 ACTION_NOT_ALLOWED. An endpoint that was disabled after failing for 3 days works as before: save its URL again to turn it back on.

Nothing is removed or renamed.