PayPal doesn't require merchants to allowlist specific IP addresses to access PayPal Classic or REST APIs. However, PayPal does offer optional IP address allowlisting features for Payflow Pro and PayPal Manager.

Allowlist access to Payflow Pro
To increase security, you can specify up to 16 different IP addresses that can access Payflow Pro APIs. Here's how:  

• Only admin users can modify this information. If you don't have admin privileges, you can view only the allowed IP addresses.
• Access from all IP addresses outside your specified list is blocked.

1. Log in to your PayPal Manager account.
2. Select Account Administration > Allowed IP Addresses (For API Transaction Processing).
3. Enter up to 16 server IP addresses to allowlist, then click Update.

• To represent a range of IP addresses, use the asterisk (*) character.
• Each IP address must be Internet-facing.

Note: IP Addresses can be temporarily blocklisted if the API traffic appears malicious. If you're experiencing API timeouts, see How do I resolve API timeout problems?

Allowlist access to PayPal Manager
You can also allowlist specific IP addresses that can access your PayPal Manager account. Enabling this feature blocks access from any IP address outside your specified list.

Note: Only admin users can modify this information. If you don't have admin privileges, you can view only the allowed IP addresses.

1. Log in to PayPal Manager.
2. Select Account Administration > Allowed IP Addresses (For PayPal Manager Access).
3. Enter up to 16 IP addresses to whitelist, then click Update.

• To represent a range of IP addresses, use the asterisk (*) character.
• Each IP address must be Internet-facing.