Whitelist

Limit where withdrawal requests may come from, and where money may go.

Whitelist	What it limits	Who sets it
API IP Whitelist	The IPs that may order a withdrawal through the API	Agent Owner, in the dashboard
Destination whitelist	The bank accounts and wallets that a dashboard withdrawal may pay to	Agent Owner, in the dashboard
Webhook source IPs	The IPs your server accepts webhooks from	You, on your firewall

API IP Whitelist

When the whitelist is on, POST /v1/withdrawal/createRequest/fiat is accepted only from the IPs on your list. Even if the API key and secret leak, a withdrawal cannot be ordered from another network.

Find the outbound IP of your server

Use the IP that your server presents to the internet. If you run several servers or go through a NAT gateway, collect every outbound IP.

curl https://api.ipify.org

Add the IP in the dashboard

Open the Developer page of the agent and press Add IP on the API IP Whitelist card. Only the Agent Owner can add an entry, and the system asks for the PIN Code and an authenticator code to confirm.

EXACT	`203.0.113.5`	One IP address
CIDR	`203.0.113.0/24`	A range. The prefix is 0 to 32
GLOB	`203.0.113.*`	IPv4 only, four parts separated by dots

Test a withdrawal from that server

A request from an IP that is not on the list receives 403 with the body below. If your own server receives it, the outbound IP differs from the one you added.

{
  "error": {
    "code": 2003,
    "message": "ไม่พบ IP ในรายการที่อนุญาต",
    "detail": "IP not in agent whitelist"
  },
  "success": false
}

To edit or remove an entry, please contact our team. Entries cannot be removed from the shop side.
Please add the new IP before you move a server or change your network, otherwise withdrawals from the new IP are refused.
The whitelist is checked on withdrawal requests. Other calls, such as creating a payment or reading the balance, are protected by the request signature.

Destination whitelist

For withdrawals made in the dashboard. Money can go only to a bank account or a wallet that has been registered in advance.

Bank accounts (Whitelist Ebank): destination accounts for fiat withdrawals. THB only.
Wallets (Whitelist Address): destination addresses for crypto withdrawals. One wallet per chain.
Only the Agent Owner can add an entry. To edit or remove one, please contact our team.

Webhook source IPs

This one is set on your side. If your firewall filters incoming traffic, allow the IPs that the system sends webhooks from. See the IP list on Webhook Setup