Skip to main content
The allowlist works in both directions, but it is mandatory in one of them.

Your wallet callbacks

Required. Accept requests only from the Zero-Dash addresses below.

The Customer API

Optional. Give us your egress addresses and we will refuse everything else.

​
Zero-Dash source addresses

All wallet callbacks originate from these addresses:
You must accept wallet callback requests only from these addresses. Zero-Dash takes no responsibility for malicious requests reaching your endpoints from any other source address.
Enforce this at the edge — firewall, load balancer or WAF — so unauthenticated traffic never reaches your application. Signature verification stays in place as the second layer: the allowlist answers who connected, the signature answers who wrote this message.
Terminating TLS at a CDN or load balancer? Then the source IP your application sees is the proxy’s. Enforce the allowlist at the proxy itself, or trust X-Forwarded-For only from that proxy — never from the open internet.

​
Restricting the Customer API

Optional, and recommended. Send us the public egress addresses your servers call from and we will reject requests arriving from anywhere else, even correctly signed ones.

Collect your egress addresses

Every environment that will call the API: production, staging, and any NAT gateway they exit through. A stolen secret key becomes far less useful when it only works from two addresses.

Send them during onboarding

Include the environment each address belongs to. Getting this wrong locks your own integration out, so double-check before you send.

Tell us before you change them

Migrating regions, adding a NAT gateway or scaling out to new addresses? Send the update ahead of the change, not after.
Leave the Customer API allowlist unset and any source address is accepted, provided the signature and timestamp are valid.