Static IPs and AWS PrivateLink Now Available for Responder Endpoints

Overview

Lithic now sends all responder requests from a fixed, published set of IP addresses. Programs running on AWS can also receive them over AWS PrivateLink. Responder requests are the calls Lithic makes to your endpoints for Auth Stream Access (ASA), 3DS decisioning, and tokenization decisioning. Both options let you control exactly who can reach those endpoints, which strengthens your security and compliance posture.

Details

Static IPs

Each environment sends responder requests from its own fixed set of IP addresses. Allowlist these addresses in your firewall so that only Lithic can reach your responder endpoints.

The new List Lithic IP ranges endpoint returns the current addresses in CIDR notation, along with the time they last changed. The endpoint requires no API key:

• Production: GET https://api.lithic.com/v1/ip_ranges
• Sandbox: GET https://sandbox.lithic.com/v1/ip_ranges

Lithic announces new addresses at least 30 days before sending traffic from them. Event webhooks are not sent from these addresses.

Example Response

The production endpoint currently returns:

{
  "responders": [
    "3.150.185.203/32",
    "35.83.2.112/32",
    "52.28.140.90/32",
    "52.52.145.141/32",
    "52.53.48.89/32",
    "54.195.7.23/32",
    "54.71.93.49/32",
    "63.183.175.249/32",
    "63.33.118.197/32",
    "77.112.29.98/32"
  ],
  "updated": "2026-10-13T00:00:00Z"
}

AWS PrivateLink

If your infrastructure runs on AWS, Lithic can deliver responder requests over AWS PrivateLink instead of the public internet. All traffic stays on the AWS network, so your responder endpoints do not need to be reachable from the public internet. To enable PrivateLink for your program, contact your Customer Success Manager. An implementation fee may apply.

Release Timeline

Production availability: October 13, 2026

User Impact

This change is additive only. Existing integrations will continue to function without modification. If you restrict inbound traffic to Lithic's addresses, check the updated field of the List Lithic IP ranges endpoint regularly, so you can allowlist new addresses before Lithic starts sending traffic from them.

Updated Documentation

For the endpoint specification, visit our API Reference for List Lithic IP ranges.

If you have any questions or concerns, please contact us via the HELP link in your Lithic Dashboard.

The Lithic changelog has an RSS feed! To monitor for new update announcements, subscribe with your preferred RSS reader.