# Intercom IP addresses

If your network or firewall requires you to allowlist outbound traffic from Intercom, you can use the IP ranges published by Intercom for your region.

The same IP addresses are used for **all outbound traffic that leaves Intercom**, including:

- Webhook notifications
- [Canvas Kit](/docs/canvas-kit/) requests sent to your app
- Data Connector callouts (for example, [Fin Custom Helpdesk](/docs/guides/fin-custom-helpdesk/) and other Fin Data Connectors)
- Fin MCP Connector calls to your MCP server


There is no separate range per service. If a request originates from Intercom, it comes from one of the IPs listed below.

## Get the current IP ranges

Intercom publishes the live IP ranges as JSON for each region. The files are refreshed daily at 9:00 AM Dublin time, though the ranges change infrequently.

- USA: [https://static.intercomcdn.com/intercom-ips/us/intercom-ip-ranges.json](https://static.intercomcdn.com/intercom-ips/us/intercom-ip-ranges.json)
- Europe: [https://static.intercomcdn.com/intercom-ips/eu/intercom-ip-ranges.json](https://static.intercomcdn.com/intercom-ips/eu/intercom-ip-ranges.json)
- Australia: [https://static.intercomcdn.com/intercom-ips/au/intercom-ip-ranges.json](https://static.intercomcdn.com/intercom-ips/au/intercom-ip-ranges.json)


Use the IP addresses tagged with the service type `"INTERCOM-OUTBOUND"`. The JSON looks like:

```json
{
  "ip_ranges": [
    {
      "range": "34.197.76.213/32",
      "region": "US",
      "service": "INTERCOM-OUTBOUND"
    }
  ],
  "date": "2025-07-25"
}
```

Keep your allowlist up to date
New ranges are published to the JSON file before they start serving traffic, but the lead time isn't guaranteed. Fetch the file on a schedule and update your allowlist promptly so you don't miss notifications when a new range comes online. The list is region-specific — only use the file for the region your workspace is hosted in.

## Notes

- Ranges are in CIDR notation (for example, `34.197.76.213/32`).
- Only entries with `"service": "INTERCOM-OUTBOUND"` apply to outbound traffic from Intercom. Other service tags (for example, `INTERCOM-ENDPOINTS` and `INTERCOM-GENERAL`) cover Intercom's own infrastructure and aren't relevant for allowlisting traffic *to* your systems.
- This page covers traffic **from** Intercom to your systems. To restrict inbound API traffic **to** Intercom by source IP, see workspace and REST API allowlisting articles in the Intercom Help Center.
- IP allowlisting confirms the request originated from Intercom's network but doesn't prove the request was intended for your specific app. For stronger guarantees, also verify the [Canvas Kit `X-Body-Signature` header](/docs/canvas-kit/#signing-notifications) where applicable.