Skip to main content
Whitelisting the IP address or generating a public key provides a layer of authentication. These cybersecurity techniques prevent anonymous or unknown disbursement requests and allow only verified requests.
A string of characters that identifies each computer using the Internet Protocol to communicate over a network. Computers use IP addresses to communicate with each other over the internet.
Whitelisted IPs are an index of approved entities. A whitelist approves a list of email addresses, IP addresses for communication.
The Cashfree production server allows your API requests.
You can whitelist a maximum of 25 IP addresses.
No, we only support API requests from IPv4 at the moment.
An IP whitelisting error can occur if multiple Payout accounts exist and the IP address is whitelisted only on one account, but the API keys in use belong to a different account. To resolve this, whitelist the IP address on all Payout accounts and ensure the correct set of API keys is used for the intended account. Switching to the appropriate account usually fixes the issue and prevents further authentication errors.
If your IP address is not static, generate a public key in the Cashfree portal.
  1. In the Cashfree dashboard, select Developers from the navigation panel on the left.
  2. Click Two-Factor Authentication from the Payouts card.
  3. Select Public Key from the Select 2FA Method dropdown menu.
  4. Click Generate Public Key.
  5. The public key is downloaded to your computer. Use your registered email ID to access the key.
One. You can generate only 1 public key at a time.
You need to generate a signature and proceed with the API requests.Below are the steps to generate the signature:
  1. Retrieve your client ID.
  2. Append this with CURRENT UNIX timestamp separated by a period (.).
  3. Encrypt this data with the generated public key using RSA encryption - this is the signature.
  4. Pass this signature in the header X-CF-Signature.
No. Payment Gateway APIs do not require IP whitelisting. Other Cashfree products can require IP whitelisting as part of their API authentication. Check the documentation for the product whose API you are calling.If you receive a Broken Link or not enabled error during testing, confirm that you are not applying another product’s IP whitelist requirement to a Payment Gateway API call.
For the Public Key Signature Authentication flow, use the oldest (first) Client ID created for the account. To check the creation dates of your API keys, log in to the Merchant Dashboard and go to Developers > Two-Factor Authentication.To resolve a Signature Mismatched error, verify the following:
  • Pass the oldest (first) Client ID in the X-Client-Id header.
  • Form the string as clientId.unixTimestamp (Client ID, a dot, then the current UNIX timestamp).
  • Encrypt the string using RSA with OAEP padding and the public key downloaded from the Merchant Dashboard. Base64-encode the result and pass it in the X-Cf-Signature header.
  • Generate a new signature every 5 minutes. The signature is valid for 5 minutes. See 2FA: IP Whitelisting and Public Keys.
  • Use a Client ID and public key from the same environment (for example, the same Payouts or Secure ID account).
To receive Payouts webhooks, whitelist Cashfree’s IP addresses on your server. See the list in IPs to whitelist.