Before you begin integrating with the PayNearMe platform, you will need to add paynearme.com on the appropriate port or add PayNearMe's static server IP addresses to your system's allowlist . Additionally, you'll want to add the IP addresses for PayNearMe's enhanced Content Delivery Network (CDN) solution using Fastly. As a best practice, we recommend one of the following solutions:

A. If you have a web application layer firewall (WAF) (e.g., AWS WAF, F5 WAF, and Cloudflare WAF) you should allowlist via domain (preferred)

B. If you have a network firewall (IP address only), update the allowlist to include the PNM static server IP addresses and the Fastly IP addresses listed below.

Production IPs

Sandbox IPs

SFTP-Supported Configuration

Fastly IPs

{
  "addresses": [
    "23.235.32.0/20",
    "43.249.72.0/22",
    "103.244.50.0/24",
    "103.245.222.0/23",
    "103.245.224.0/24",
    "104.156.80.0/20",
    "140.248.64.0/18",
    "140.248.128.0/17",
    "146.75.0.0/17",
    "151.101.0.0/16",
    "157.52.64.0/18",
    "167.82.0.0/17",
    "167.82.128.0/20",
    "167.82.160.0/20",
    "167.82.224.0/20",
    "172.111.64.0/18",
    "185.31.16.0/22",
    "199.27.72.0/21",
    "199.232.0.0/16"
  ],
  "ipv6_addresses": [
    "2a04:4e40::/32",
    "2a04:4e42::/32"
  ]
}

Required TLS Settings

To ensure secure communication and protect data in transit, all clients connecting to our APIs must meet the following Transport Layer Security (TLS) requirements:

Minimum TLS Version

• TLS 1.2 or higher is required
• TLS 1.0 and 1.1 are not supported

Deprecated Cipher Suites

Connections using the following will be rejected:

• SSL/TLS protocols below TLS 1.2
• Cipher suites using:
  • RSA key exchange without PFS
  • SHA-1 or MD5 hashes
  • Block ciphers without AEAD (e.g., CBC without GCM)

Supported Cipher Suites

TLS 1.3

TLS 1.3 cipher suites are defined by the protocol and are AEAD-only. Key exchange and authentication are negotiated separately from the cipher suite, so suite names do not specify ECDHE, RSA, or ECDSA.

TLS 1.2

All supported TLS 1.2 cipher suites use ECDHE key exchange for forward secrecy with an AEAD cipher.

Unsupported Protocols and Cipher Suites

Connections using any of the following will be rejected with a TLS handshake failure:

• TLS protocol versions below TLS 1.2, including SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1
• Cipher suites using RSA key exchange without forward secrecy
• Cipher suites using SHA-1 or MD5 hashes
• Block ciphers without AEAD, including all CBC-mode cipher suites
• 3DES cipher suites

Commonly encountered examples:

Client Configuration Requirements

• Support TLS 1.2 or higher with ECDHE key exchange and an AES-GCM or ChaCha20-Poly1305 cipher suite.
• Keep client libraries current (OpenSSL, Java, .NET, curl, and similar). OpenSSL 1.0.1 or later, Java 8 or later, and current .NET, Go, Python, and Node.js runtimes meet these requirements by default.
• Do not hardcode specific cipher suites or TLS versions. Allow your TLS library to negotiate the strongest mutually supported option.

For full compatibility details, refer to Fastly’s TLS configuration guide.