How to allowlist Klaviyo integration traffic IP addresses
You will learn
Learn how to allowlist IP addresses for outbound Klaviyo integration traffic to ensure that your firewall is not blocking Klaviyo’s requests. All outbound Klaviyo integration traffic is behind a set of predictable, static IP addresses so that you can have a high level of confidence that this traffic is coming from Klaviyo. This is especially applicable to customers using self-hosted ecommerce integrations such as Magento 2 and WooCommerce.
Please note that integration traffic does not include flow-triggered webhook traffic, which uses different IP addresses.
What IP addresses does Klaviyo use for integration traffic?
Klaviyo sends integration traffic from multiple IP ranges. You should allowlist all of them. These IP ranges may change over time.
To keep your firewall allowlist up to date, use the Get Client IP Allowlist endpoint. You can query this endpoint regularly and use the response to programmatically update your firewall configuration.
If you are configuring your allowlist manually, allowlist both of the following IP ranges:
- 207.211.192.0/20 — covers 207.211.192.0 – 207.211.207.255
- 207.186.206.0/24 — covers 207.186.206.0 – 207.186.206.255
If you are restricted from allowlisting /20 ranges, the first range can be represented as 16 /24 ranges. The second range is already a /24, so no change is needed. The full /24 list to allowlist is:
207.211.192.0/24207.211.193.0/24207.211.194.0/24207.211.195.0/24207.211.196.0/24207.211.197.0/24207.211.198.0/24207.211.199.0/24207.211.200.0/24207.211.201.0/24207.211.202.0/24207.211.203.0/24207.211.204.0/24207.211.205.0/24207.211.206.0/24207.211.207.0/24207.186.206.0/24
How-to examples
How to allowlist in Cloudflare
For Cloudflare IP Access rules, allowlist all 17 of the /24 ranges given above. These rules support IPv4 /16 and /24 ranges, so split the /20 range into /24 ranges as shown.
The Allow action bypasses custom rules, rate limiting rules, and WAF Managed Rules for matching IP addresses. Apply these rules only to the website used by your integration.
In your Cloudflare dashboard, follow Cloudflare’s instructions for creating an IP Access rule. Choose the Allow action and create a rule for each of the 17 /24 ranges above.
If you do not see IP access rules in the dashboard, use the API option in Cloudflare’s rule-creation guide. The dashboard option appears only after at least 1 IP access rule exists.
You can learn more about IP access rules in Cloudflare’s documentation.
How to allowlist in Akamai Identity Cloud
These instructions apply to Akamai Identity Cloud property API access. If you use an Akamai firewall to protect your ecommerce store, follow the instructions for that security product.
In the Identity Cloud Console, add 207.211.192.0/20 and 207.186.206.0/24 to the relevant property’s IP allowlist, then save your changes using Akamai’s documentation below.
You can learn more about managing IP allowlists in Akamai’s documentation.
Outcome
After saving your allowlist, check that Klaviyo integration requests reach your store. If requests are still blocked, check your firewall or security provider’s logs for other rules affecting them. Recheck the Get Client IP Allowlist endpoint regularly to keep your allowlist current.
Additional resources
- Troubleshooting your Magento 2 integration
Learn how to solve issues with your Magento 2 OAuth setup by following the troubleshooting steps described below. If you are still encountering issues after running through these steps, please reach out on our Community or to our Support Team.
- Troubleshooting your WooCommerce integration
Learn how to solve issues with your WooCommerce integration setup by following the relevant troubleshooting scenario described below. If you are encountering issues not on this list, please reach out on the Community or to our Support Team.