IP Addresses & API Domain

Notification IP Address

Midtrans sends (outgoing) HTTP notifications / webhook status update from various IP addresses to your notification url (as backend to backend request). In case your system needs to whitelist IP addresses, please add Midtrans CIDR given below to your whitelist.

Production Environment:
103.208.23.0/24
103.208.23.6/32
103.127.16.0/23
103.127.17.6/32
34.87.92.33
34.87.59.67
35.186.147.251
34.87.157.231
13.228.166.126/32
52.220.80.5/32
3.1.123.95/32
108.136.204.114
108.136.34.95
108.137.159.245
108.137.135.225
16.78.53.66
43.218.2.230
16.78.88.149
16.78.85.64
16.78.69.49
16.78.98.130
16.78.9.40
43.218.223.26

Sandbox Environment : 
34.101.68.130
34.101.92.69

Although we are providing the IP list, we don’t quite recommend relying on IP whitelisting to ensure notification authenticity. Instead, we strongly recommend you to verify the authenticity by implementing the methods explained here.

📘
If you are unable to receive notification from Midtrans, please ensure that your infrastructure is allowing HTTPs connection from the above-mentioned IP addresses. Additionally try to follow this troubleshooting section.

API Domain Endpoint

📘
Midtrans API endpoints & URLs are publicly accessible via the internet, by default you won’t need to whitelist anything on your side to be able to send API requests to Midtrans.
But only in case your network/infrastructure setup need to, or if you are still unable to send request to Midtrans, please ensure that you have whitelisted the mentioned domain names below.

Midtrans API endpoint is distributed and protected with multiple layers of security, it does not have any specific IP address. So, please whitelist our API domain names mentioned below.

api.midtrans.com
app.midtrans.com
api.veritrans.co.id

api.sandbox.midtrans.com
app.sandbox.midtrans.com
api.sandbox.veritrans.co.id
simulator.sandbox.midtrans.com

If it is necessary for you to whitelist IP addresses instead of the Domain name, you can refer to the IP range list. Although this is not recommended. Do so at your own risk, as the IP range may change without notice, which poses the risk of breaking your integration.