Before you begin integrating with the PayNearMe platform, you will need to add paynearme.com on the appropriate port or add PayNearMe's static server IP addresses to your system's allowlist . Additionally, you'll want to add the IP addresses for PayNearMe's enhanced Content Delivery Network (CDN) solution using Fastly. As a best practice, we recommend one of the following solutions:

A. If you have a web application layer firewall (WAF) (e.g., AWS WAF, F5 WAF, and Cloudflare WAF) you should allowlist via domain (preferred)

B. If you have a network firewall (IP address only), update the allowlist to include the PNM static server IP addresses and the Fastly IP addresses listed below.

📘

PayNearMe Allowlist

PayNearMe's preferred allowlist configuration is via the paynearme.com and paynearme-sandbox.com domains. PayNearMe does NOT restrict inbound or response IPs.

Production IPs

Sandbox IPs

SFTP-Supported Configuration

Fastly IPs

🚧

Updated IP List

To ensure you have the most updated list of Fastly IP addresses, please copy and paste the list provided by Fastly here to your network and firewall rules. While we make every effort to ensure the list displayed below is kept updated, using the dynamic list provided directly from Fastly will ensure your service remains uninterrupted.

{
  "addresses": [
    "23.235.32.0/20",
    "43.249.72.0/22",
    "103.244.50.0/24",
    "103.245.222.0/23",
    "103.245.224.0/24",
    "104.156.80.0/20",
    "140.248.64.0/18",
    "140.248.128.0/17",
    "146.75.0.0/17",
    "151.101.0.0/16",
    "157.52.64.0/18",
    "167.82.0.0/17",
    "167.82.128.0/20",
    "167.82.160.0/20",
    "167.82.224.0/20",
    "172.111.64.0/18",
    "185.31.16.0/22",
    "199.27.72.0/21",
    "199.232.0.0/16"
  ],
  "ipv6_addresses": [
    "2a04:4e40::/32",
    "2a04:4e42::/32"
  ]
}

Required TLS Settings

To ensure secure communication and protect data in transit, all clients connecting to our APIs must meet the following Transport Layer Security (TLS) requirements:

Minimum TLS Version

• TLS 1.2 or higher is required
• TLS 1.0 and 1.1 are not supported

Deprecated Cipher Suites

Connections using the following will be rejected:

• SSL/TLS protocols below TLS 1.2
• Cipher suites using:
  • RSA key exchange without PFS
  • SHA-1 or MD5 hashes
  • Block ciphers without AEAD (e.g., CBC without GCM)

Cipher Suite Requirements for Clients

• Ensure your client libraries (e.g., OpenSSL, Java, curl) are up to date
• Validate that your system negotiates TLS 1.2+ with modern cipher support according to Fastly’s TLS Guidelines
• Avoid hardcoding legacy ciphers or TLS versions

The following ciphers are supported on TLS 1.2, the minimum standard version of TLS supported by Fastly.

For full compatibility details, refer to Fastly’s TLS configuration guide.

👍

Security Checkup

For a step-by-step guide on how to check your site's TLS version and cipher suites, see Reviewing Your TLS Version and Cipher Suites.