Skip to main content
From November 1, 2026 these addresses are no longer a commitment. The gateway is moving to Cloudflare’s edge network, and requests from the edge reach your servers from Cloudflare’s addresses. If your firewall only lets the addresses below in, switch to a secret header before your API moves.

​
What is changing

APIs are moving one at a time from the classic gateway to the edge gateway, where every API runs as its own Worker close to the consumer. The move completes on November 1, 2026: from that day every API is served from the edge. The My APIs list in Studio shows where each of yours is today: Classic (not moved yet), or Template and Code (on the edge).
  • Until your API moves, requests to your servers come from the classic gateway’s addresses.
  • Once it moves, they come from Cloudflare’s network. Those addresses are not fixed and are shared by every Cloudflare customer, so allowlisting them would let in far more than JoJ API. Don’t use them to recognize our traffic.
  • Nothing else changes: your API’s address (your-api.jojapi.net), your consumers’ keys, your plans, pricing and payouts stay the same.
If you don’t filter traffic by IP address, there is nothing to do.

​
Recognize requests with a secret header

Have the gateway send a header that only JoJ API knows, and let your server accept only requests that carry it. It works on both gateways, so you can set it up now and it carries over when your API moves.
  1. In Studio, open your API’s Worker tab, or Target if your API is still on the classic gateway.
  2. Add a request header, for example X-Origin-Secret, with a long random value (32 characters or more). On the Worker tab, save the value as a secret variable such as ORIGIN_SECRET and set the header to {env.ORIGIN_SECRET}. On the Target tab, type the value itself; with a name like X-Origin-Secret it is moved into a secret variable automatically when your API moves.
  3. Make your server reject requests without that header and value:
    In application code, compare the value with a constant-time comparison.
  4. Check that your API still answers through the gateway, then remove the IP rule.
To rotate the secret without downtime, accept both the old and the new value on your server, save the new value in Studio, then drop the old one.

​
Classic gateway addresses

Until November 1, 2026, the classic gateway sends requests to your servers from these addresses and ranges:

​
Fetching the list programmatically

If an automation keeps your firewall allowlist in sync, it can read the addresses from this endpoint:
IPv4 addresses and IPv6 ranges are returned separately because firewall rules for the two rarely take the same form. updated_at moves only when the addresses themselves change. deprecated and sunset say that the list stops being a commitment on that date; the response also carries the standard Deprecation, Sunset and Link headers, so tools that watch for them flag the endpoint. The response is cached for one hour.