Skip to main content

IP Whitelisting

IP whitelisting restricts access to your Exotel account's API to requests originating from specific, pre-approved IP addresses. This adds an extra layer of security beyond API key authentication, ensuring only your authorized servers can interact with Exotel's APIs.

tip

IP whitelisting is available on Growth and Enterprise plans. Starter plan users can secure their integrations using API key authentication and HTTPS.

How IP Whitelisting Works​

When IP whitelisting is enabled:

  1. Your server sends an API request to Exotel
  2. Exotel checks the source IP address of the request
  3. If the IP is in your whitelist, the request proceeds normally
  4. If the IP is NOT in your whitelist, the request is rejected with HTTP 403
Your Server (IP: 203.0.113.10) ──► Exotel API
   │
   ├── IP in whitelist? ──► Yes ──► Request processed
   │
   └── IP not in whitelist? ──► No ──► HTTP 403 Forbidden

Configuring IP Whitelisting​

Via Dashboard​

  1. Log in to my.exotel.com
  2. Navigate to Settings > Security > IP Whitelisting
  3. Toggle Enable IP Whitelisting to ON
  4. Add your server IP addresses (see below)
  5. Click Save

Adding IP Addresses​

FormatExampleDescription
Single IP203.0.113.10One specific IP address
CIDR range203.0.113.0/24A range of 256 IP addresses
Multiple IPsAdd one per lineList all your server IPs
ServerIP to Whitelist
Production API serverYour production server's public IP
Staging/test serverYour staging environment's public IP
CI/CD pipelineYour build server's IP (if it runs API tests)
Developer machinesIndividual developer IPs (for development only)
Load balancer / NAT gatewayThe outbound IP of your NAT or load balancer
warning

If your servers use dynamic IPs (e.g., auto-scaling cloud instances behind a NAT gateway), whitelist the NAT gateway's IP or the Elastic IP associated with your VPC, not individual instance IPs.

Whitelisting Exotel's IPs (Incoming Webhooks)​

To secure your webhook endpoints, accept requests only from Exotel's IP addresses. Whitelist the following ranges in your server's firewall or application-level security:

Exotel IP Ranges​

RegionIP RangesPurpose
India (Primary)Contact Exotel support for current rangesAPI callbacks, webhooks
SingaporeContact Exotel support for current rangesAPAC region callbacks
info

Exotel's IP ranges may change over time. Subscribe to the Changelog or contact your account manager to receive notifications about IP range changes.

Firewall Configuration​

Configure your firewall to:

  1. Allow inbound HTTPS (port 443) from Exotel's IP ranges to your webhook endpoint
  2. Allow outbound HTTPS (port 443) from your server to Exotel's API endpoints
  3. Block all other inbound traffic to your webhook endpoint

Dual-Direction Whitelisting​

For maximum security, implement whitelisting in both directions:

DirectionWhat to WhitelistWhere to Configure
Outbound (your API calls)Your server IPs in ExotelExotel Dashboard > IP Whitelisting
Inbound (Exotel webhooks)Exotel's IPs in your firewallYour server/cloud firewall rules

Managing IP Whitelists​

Adding an IP​

  1. Navigate to Settings > Security > IP Whitelisting
  2. Click Add IP
  3. Enter the IP address or CIDR range
  4. Add a label for identification (e.g., "Production Server")
  5. Click Save

Removing an IP​

  1. Navigate to the IP Whitelisting page
  2. Find the IP you want to remove
  3. Click the Remove icon
  4. Confirm the removal
  5. Click Save
warning

Removing an IP immediately blocks API requests from that address. Ensure you have updated your server to use a whitelisted IP before removing the old one.

Disabling IP Whitelisting​

To disable IP whitelisting entirely:

  1. Navigate to Settings > Security > IP Whitelisting
  2. Toggle Enable IP Whitelisting to OFF
  3. Confirm the change
  4. All API requests will be accepted regardless of source IP (standard API key auth still applies)

Troubleshooting​

IssuePossible CauseResolution
API returns 403 after enablingServer IP not whitelistedAdd your server's public IP to the whitelist
403 error intermittentServer behind a load balancer with multiple outbound IPsWhitelist all outbound IPs or use a static NAT IP
Webhooks not receivedYour firewall blocking Exotel's IPsWhitelist Exotel's IP ranges in your firewall
Cannot determine server IPCloud infrastructure with dynamic IPsUse a NAT gateway with a static Elastic IP
Locked out after misconfigurationAll IPs removed or wrong IPs addedContact Exotel support to reset IP whitelisting

Finding Your Server's Public IP​

If you are unsure of your server's outbound public IP, run this command from your server:

curl -s https://api.ipify.org

This returns the public IP address that Exotel sees when your server makes API requests.

Best Practices​

  1. Use CIDR ranges for cloud environments -- If your servers share a subnet, whitelist the entire CIDR block
  2. Always whitelist before enabling -- Add all your IPs first, then enable whitelisting to avoid lockouts
  3. Keep the list minimal -- Only whitelist IPs that genuinely need API access
  4. Label your IPs -- Add descriptive labels to each IP for easy management
  5. Review regularly -- Audit your whitelist quarterly and remove IPs that are no longer in use
  6. Use dual-direction whitelisting -- Protect both your API calls and webhook endpoints
  7. Plan for failover -- If you have disaster recovery servers, whitelist their IPs proactively