Skip to main content

​
IP whitelisting

IP Whitelisting adds an additional security layer by allowing API access only from trusted server IP addresses configured on your Elite Neo Bank merchant account. When IP Whitelisting is enabled:
  • Only approved server IPs can access production APIs
  • Unauthorized requests are automatically blocked
  • API security is significantly improved
IP Whitelisting is strongly recommended for all production merchants handling payments and payouts.

​
Why IP Whitelisting is Important

IP Whitelisting helps protect against:
  • Unauthorized API access
  • Credential misuse
  • Malicious API requests
  • Unauthorized payout attempts
  • External attack vectors
Even if API credentials are compromised, requests from unapproved IP addresses will be rejected.

​
How IP Whitelisting Works

When a request reaches the Elite Neo Bank infrastructure:
  1. The source server IP is validated
  2. The IP is matched against approved merchant IPs
  3. Requests from approved IPs are processed
  4. Requests from unapproved IPs are blocked automatically
IP Whitelisting is highly recommended for:
  • Production payment systems
  • Payout processing systems
  • Banking integrations
  • Financial reconciliation systems
  • Backend transaction services
Whitelist only trusted backend infrastructure such as:
  • Dedicated servers
  • Cloud application servers
  • Secure API gateways
  • Production backend systems
  • VPN-restricted infrastructure
Avoid whitelisting:
  • Personal devices
  • Dynamic residential IPs
  • Public networks
  • Development machines

​
Example Production Request Headers

​
Supported IP Types

Elite Neo Bank supports:
  • IPv4 addresses
  • Static public IPs
  • Dedicated cloud server IPs
Example:

​
Multiple IP Support

Merchants may whitelist multiple IP addresses for:
  • Load-balanced infrastructure
  • Multi-server deployments
  • Backup production systems
  • Disaster recovery environments

​
Environment Separation

Sandbox and production environments may use different IP configurations. Ensure:
  • Production IPs are whitelisted separately
  • Sandbox testing IPs are configured correctly
  • Environment credentials are not mixed

​
IP Change Management

If your production server IP changes:
  1. Contact Elite Neo Bank support
  2. Submit updated IP addresses
  3. Wait for confirmation before sending production traffic
Requests from unapproved IPs may fail immediately.

​
Example Access Failure

If a request originates from a non-whitelisted IP:

​
Common Reasons for IP Rejection

Possible reasons:
  • Incorrect production IP
  • Dynamic IP changes
  • Load balancer IP mismatch
  • Cloud infrastructure migration
  • Environment configuration issues

​
Security Recommendations

  • Use static public IPs only
  • Restrict API access to backend servers
  • Rotate credentials periodically
  • Combine IP Whitelisting with webhook verification
  • Monitor unauthorized access attempts

​
Best Practices

  • Maintain updated IP records
  • Whitelist backup infrastructure carefully
  • Review IP access regularly
  • Remove unused IPs immediately
  • Avoid exposing production APIs publicly

​
Operational Recommendations

Merchants should maintain:
  • IP inventory records
  • Infrastructure documentation
  • Backup IP procedures
  • Emergency access escalation workflows

​
Important Notes

  • IP Whitelisting is a production security feature
  • Whitelisting does not replace signature verification
  • All API requests must still include valid authentication headers
  • Requests from blocked IPs will not reach transaction processing systems
Elite Neo Bank recommends combining:
  • IP Whitelisting
  • HMAC SHA256 signatures
  • HTTPS-only communication
  • Webhook verification
  • Replay attack protection
  • Secure credential storage
for maximum production security.

​
Geo-Restricted IP Access

For additional compliance and fraud prevention, Elite Neo Bank may enforce geo-restricted API access for payout services. This means payout APIs should generally be accessed only from server infrastructure located in the same country as the registered merchant entity. Example:
  • Indian merchants should use Indian server infrastructure
  • UAE merchants should use UAE-hosted infrastructure
  • UK merchants should use UK-hosted infrastructure

​
Why Geo Restrictions are Important

Geo-restricted access helps:
  • Prevent unauthorized international payout activity
  • Reduce fraud risks
  • Improve regulatory compliance
  • Enhance banking security controls
  • Protect merchant payout infrastructure

​
Example

If a merchant account is registered in India: ✅ Recommended:
  • India-based cloud servers
  • India-hosted backend infrastructure
  • Indian static public IP addresses
❌ Not Recommended:
  • Foreign VPS servers
  • International proxy routing
  • Dynamic overseas infrastructure

​
Supported Infrastructure

Recommended hosting providers:
  • AWS India
  • Google Cloud India
  • Azure India
  • Indian dedicated server providers
  • Secure India-based VPS infrastructure

​
Important Notes

  • Geo validation may apply only to payout APIs
  • Payment Gateway APIs may have different restrictions
  • Cross-border payout enablement may require additional approval
  • Certain international payout corridors may support global infrastructure separately

​
Compliance Recommendations

Merchants should:
  • Use static public IPs
  • Host payout systems in the merchant operating country
  • Avoid routing payout APIs through VPNs or proxies
  • Maintain infrastructure compliance documentation

​
Security Recommendations

Elite Neo Bank recommends combining:
  • Geo-restricted IP access
  • IP whitelisting
  • HMAC SHA256 signatures
  • HTTPS-only communication
  • Webhook verification
for maximum payout security.