Skip to main content
If your test target or the APIs your hooks call sit behind a firewall, allowlist Autosana’s source IPs. The current list is at GET /api/v1/network/allowlist.
If your web app is not reachable from public Autosana runner IPs because it lives inside a Tailscale tailnet, use the Tailscale integration instead of IP allowlisting.
Grab YOUR_API_KEY from Settings → Integrations.
  • hook_runners — source IPs for HTTP traffic from hook scripts. Stable; rarely changes. Allowlist on firewalls protecting APIs your hooks call.
  • flow_runners.virtual_runners — source IPs for iOS simulators, Android emulators, and web browsers hosted by Autosana.
  • flow_runners.real_device_runners — shared source CIDRs for iOS and Android real devices. Allowlist these ranges when running on real devices.
Runner ranges can change as Autosana scales or its infrastructure providers update their networks.

​
Webhooks

Run-result webhooks are sent from the same IPs as flow_runners.virtual_runners. Allowlist those on the endpoint that receives them. The Test button on a webhook in Settings > Integrations > Webhooks sends from Autosana’s API, whose IPs are not in this list. If your endpoint allowlists only the runner IPs, test webhooks can be blocked while real deliveries arrive.

​
Staying in sync

We don’t notify when IPs change — the endpoint is the source of truth. Two patterns:
  1. Poll from firewall-as-code (Terraform, Cloudflare Worker, CI cron). The endpoint sends Cache-Control: max-age=300, so daily polling is cheap.
  2. Manual refresh. Pull once a month, paste into your firewall.
If hooks start returning 401/403 or flows hit connection errors against your test target, your allowlist is likely stale — pull the endpoint and diff. If run-result webhooks stop arriving at a firewalled endpoint, do the same.