# Egress IP addresses

> The static IP addresses ShopAssist connects to your store from, for firewall and WAF allowlists.

Source: https://shopassist.coec.dk/docs/security/egress-ips · Updated 2026-10-01

When ShopAssist calls your store (the Magento, WooCommerce or PrestaShop plugin, Generic feeds and the Generic order RPC), the requests come from these static IPv4 addresses. They do not change when we rebuild or move servers.

The addresses are published here before launch. Until then, allowlist the User-Agent described on this page.

Allowlist **all** listed addresses, including reserved ones, so a failover does not break your connection. IPv6 is not used.

## When to allowlist [#when]

If a firewall, Cloudflare, Sucuri, Wordfence or another WAF blocks unknown clients, connecting fails with [`waf_blocked`](/docs/troubleshooting/connection-errors#waf_blocked) or syncs fail with a challenge page. Allowlist the addresses above for:

* Magento: `/rest/*/V1/shopassist/*`
* WooCommerce: `/wp-json/shopassist/v1/*`
* PrestaShop: the ShopAssist module's front controller
* Generic: your feed URLs and your order RPC endpoint

## Identifying our requests [#user-agent]

Requests carry one of these User-Agents (see [ShopAssist bot](/docs/bot)):

* `ShopAssist-Connector/1.0 (+https://shopassist.coec.dk/bot)` for plugin and RPC calls;
* `ShopAssist/1.0 (+https://shopassist.coec.dk/bot)` for the knowledge crawler and feeds.

User-Agents can be faked; allowlist by IP address, and verify that plugin requests are signed (the plugins do this automatically).