Stripe IP Ranges
Stripe publishes two short lists as JSON: the addresses its API is served from and the addresses its webhooks are sent from. Neither uses prefixes - every entry is one IP. On 16 October 2026 the API list held 162 addresses and the webhook list 15, all IPv4, and every one of the 177 was announced by Amazon: 156 by AS16509 and 21 by AS14618.
- Provider
- Stripe
- Hosting network
- AS16509 (Amazon Web Services, host)
- Category
- Tech
- Headquarters
- South San Francisco, CA, USA
- Published IPv4 prefixes
- 177
- Registry
- Self-published list
Known IP ranges
Stripe does not announce these addresses under an ASN of its own. They are the prefixes it publishes in https://stripe.com/files/ips/ips_api.json, https://stripe.com/files/ips/ips_webhooks.json, as fetched on 2026-10-16; the space itself is routed by AS16509 (Amazon Web Services). The list decides whether an address belongs to Stripe - WHOIS for any of them returns the host network.
3.18.12.63/32
3.69.109.8/32
3.120.168.93/32
3.130.192.231/32
13.55.5.15/32
13.55.153.188/32
13.56.126.253/32
13.56.173.200/32
13.56.173.232/32
13.57.90.254/32
What does a Stripe IP mean in a privacy test?
A Stripe address is Stripe's platform, never a person. In your server log it is a webhook delivery - a payment succeeded, a subscription renewed. Seen from your side as a destination, it is your code calling the Stripe API. Neither has anything to do with a visitor's VPN.
Two lists for two directions
stripe.com/files/ips/ips_webhooks.json holds the WEBHOOKS array: the 15 addresses Stripe sends event notifications from. These are the ones an inbound firewall rule on a webhook endpoint should admit, and because there are only fifteen, they fit in a rule without summarising.
stripe.com/files/ips/ips_api.json holds the API array: 162 addresses that api.stripe.com resolves to around the world. They matter for the opposite case - an egress firewall that only lets your servers reach named destinations. Mixing the two up is the usual mistake: the API list is ten times longer and does not contain the webhook senders.
The address check is the weak one
Every address in both lists is in Amazon's space, shared with every other AWS customer in the same region. An address check alone therefore proves less than it seems. Stripe signs every webhook with a Stripe-Signature header computed from the endpoint's signing secret, and its libraries verify it; that signature is what proves a delivery came from Stripe. The address list is a useful second filter, and the only one available before the request body is read.
Because the lists are single IPs rather than ranges, they change by whole addresses when Stripe adds capacity. A rule copied once will slowly go stale; fetch the JSON on a schedule.
Related tools
Frequently asked questions
What IP addresses does Stripe use?
Two published lists: 162 API addresses in stripe.com/files/ips/ips_api.json and 15 webhook addresses in ips_webhooks.json, checked on 16 October 2026. All are single IPv4 addresses on AWS.
Why does a Stripe IP appear in my logs or a privacy test?
A Stripe address is Stripe's platform, never a person. In your server log it is a webhook delivery - a payment succeeded, a subscription renewed. Seen from your side as a destination, it is your code calling the Stripe API. Neither has anything to do with a visitor's VPN.
Which IPs do Stripe webhooks come from?
The 15 addresses in stripe.com/files/ips/ips_webhooks.json. The API list is a different set and does not include them, so an inbound rule built from it would block webhooks.
Is allowlisting Stripe's IPs enough to secure a webhook endpoint?
No. The addresses are on shared AWS infrastructure. Verify the Stripe-Signature header against your endpoint's signing secret; treat the address list as an extra filter, not as proof.
Why does WHOIS say Amazon for a Stripe IP?
Stripe runs on AWS. All 177 published addresses were announced by Amazon's AS16509 (156) or AS14618 (21) on 16 October 2026, so the registry record names Amazon.