IP whitelist
The IP of the system from which you make your request has to be whitelisted to connect with the Cashfree production server. If the IP is not whitelisted, Cashfree will reject all incoming requests. To whitelist your IP,- Log in to the Merchant Dashboard.
- Go to Payouts Dashboard > Developers section on the left-side navigation > Payouts > Two-Factor Authentication > IP Whitelist.
- Click Add IP Address.
- Enter the IP Address you want to whitelist and save the details. All the IP’s you have whitelisted will be displayed as shown below. You can whitelist a maximum of 10 IPs.

x-cf-signature header. Ensure that your Public Key is selected in the Merchant Dashboard.
You might encounter an IP whitelisting error even after whitelisting your IP address. This error typically occurs when you have multiple Payout accounts and the IP address is whitelisted on one account, but the API keys you’re using belong to a different account.
To resolve this issue, whitelist the IP address on all your Payout accounts. Also, verify that you’re using the correct API keys for the intended account. Switching to the appropriate account usually resolves the issue and prevents further authentication errors.
Please note that the IPv4 has to be whitelisted, not IPv6.
Public key
If you do not have a static IP, you can generate a public key and pass it with the API request.- Log in to the Merchant Dashboard.
- Go to Payouts Dashboard > Developers section on the left-side navigation > Payouts > Two-Factor Authentication > Public Key.
- Click Generate Public Key. The public key downloads to your computer, and the access password is sent to your registered email.

- Retrieve your clientId (one which you are passing through the header X-Client-Id )
- Append this with CURRENT UNIX timestamp separated by a period (.)
- Encrypt this data using RSA encrypt with Public key you received – this is the signature.
- Pass this signature through the header X-Cf-Signature.
FAQs
Why do I have to whitelist the IP address or generate a public key?
Why do I have to whitelist the IP address or generate a public key?
What is an IP address?
What is an IP address?
What does it mean to whitelist an IP?
What does it mean to whitelist an IP?
What happens after I whitelist my IP address?
What happens after I whitelist my IP address?
How many IP addresses can I whitelist?
How many IP addresses can I whitelist?
Does Cashfree support IPv6?
Does Cashfree support IPv6?
Why does an IP whitelisting error occur even after whitelisting an IP, and how can it be resolved?
Why does an IP whitelisting error occur even after whitelisting an IP, and how can it be resolved?
When do I use a public key?
When do I use a public key?
How to generate a public key from the Cashfree portal?
How to generate a public key from the Cashfree portal?
- In the Cashfree dashboard, select Developers from the navigation panel on the left.
- Click Two-Factor Authentication from the Payouts card.
- Select Public Key from the Select 2FA Method dropdown menu.
- Click Generate Public Key.
-
The public key is downloaded to your computer. Use your registered email ID to access the key.

How many public keys can I generate at a time?
How many public keys can I generate at a time?
How to use the public key to send API requests?
How to use the public key to send API requests?
- Retrieve your client ID.
- Append this with CURRENT UNIX timestamp separated by a period (.).
- Encrypt this data with the generated public key using RSA encryption - this is the signature.
- Pass this signature in the header X-CF-Signature.
Do Payment Gateway (PG) APIs require IP whitelisting?
Do Payment Gateway (PG) APIs require IP whitelisting?
Broken Link or not enabled error during testing, confirm that you are not applying another product’s IP whitelist requirement to a Payment Gateway API call.Which Client ID should I use for Public Key Signature Authentication, and how do I resolve a 'Signature Mismatched' error?
Which Client ID should I use for Public Key Signature Authentication, and how do I resolve a 'Signature Mismatched' error?
Signature Mismatched error, verify the following:-
Pass the oldest (first) Client ID in the
X-Client-Idheader. -
Form the string as
clientId.unixTimestamp(Client ID, a dot, then the current UNIX timestamp). -
Encrypt the string using RSA with OAEP padding and the public key downloaded from the Merchant Dashboard. Base64-encode the result and pass it in the
X-Cf-Signatureheader. - Generate a new signature every 5 minutes. The signature is valid for 5 minutes. See 2FA: IP Whitelisting and Public Keys.
-
Use a Client ID and public key from the same environment (for example, the same Payouts or Secure ID account).
Which Cashfree IP addresses should I whitelist in my server firewall?
Which Cashfree IP addresses should I whitelist in my server firewall?