Verified BursaPay gateway workflow: Explains optional IP restrictions available on API keys and the webhook-side network restriction for Paystack.
1. Overview & Purpose
Developer API keys can store an IP allowlist, while the Paystack webhook receiver also validates the incoming client IP against the configured Paystack allowlist.
2. Requirements & Setup
Know the stable egress IP addresses used by the integration.
3. Step-by-Step Workflow
- Identify the integration server egress IPs.
- Add only the required addresses to the key allowlist.
- Test requests from an allowed address.
- Verify that an unapproved address is rejected.
4. Rules & Troubleshooting
Changing infrastructure without updating allowlisted addresses can block otherwise valid API calls.
5. Verification & Next Steps
Keep network controls documented alongside deployment infrastructure.