IP Addresses & API Domain

Notification IP Address

Midtrans sends (outgoing) HTTP notifications / webhook status update from various IP addresses to your notification url (as backend to backend request). In case your system needs to whitelist IP addresses, please add Midtrans CIDR given below to your whitelist.

Production Environment:
103.208.23.0/24
103.208.23.6/32
103.127.16.0/23
103.127.17.6/32
34.87.92.33
34.87.59.67

Sandbox Environment : 
34.101.68.130
34.101.92.69

🚧

Change Notice for Production Environment per Jan 20th, 2023

As part of improving our service reliability

• New IP addresses are added: 34.87.92.33 and 34.87.59.67
• The older IP ranges with prefixes of 103.x.x.x will gradually no longer be used, a few weeks after.

Although we are providing the IP list, we don’t quite recommend relying on IP whitelisting to ensure notification authenticity. Instead, we strongly recommend you to verify the authenticity by implementing the methods explained here.

📘

If you are unable to receive notification from Midtrans, please ensure that your infrastructure is allowing HTTPs connection from the above-mentioned IP addresses. Additionally try to follow this troubleshooting section.

API Domain Endpoint

📘

Midtrans API endpoints & URLs are publicly accessible via the internet, by default you won’t need to whitelist anything on your side to be able to send API requests to Midtrans.

But only in case your network/infrastructure setup need to, or if you are still unable to send request to Midtrans, please ensure that you have whitelisted the mentioned domain names below.

Midtrans API endpoint is distributed and protected with multiple layers of security, it does not have any specific IP address. So, please whitelist our API domain names mentioned below.

api.midtrans.com
app.midtrans.com
api.veritrans.co.id

api.sandbox.midtrans.com
app.sandbox.midtrans.com
api.sandbox.veritrans.co.id
simulator.sandbox.midtrans.com

If it is necessary for you to whitelist IP addresses instead of the Domain name, you can refer to the IP range list. Although this is not recommended. Do so at your own risk, as the IP range may change without notice, which poses the risk of breaking your integration.