DocumentationExperience Cloud KCS

Adobe I/O Mesh static IP allowlisting requirements and alternatives

Last update: August 31, 2026

This article describes the options for IP allowlisting with Adobe I/O Mesh, clarifying the availability of dedicated static IP addresses and providing recommended alternatives when fixed IPs are required.

Description description

Environment

  • Adobe I/O Mesh
  • Adobe Experience Manager (all versions)

Issue/Symptoms

  • Organizations require a dedicated or static IP address for allowlisting Adobe I/O Mesh traffic in firewall or backend systems.
  • There is a need to understand whether fixed egress IPs are available for Adobe I/O Runtime or API Mesh.

Cause

Adobe I/O Mesh and I/O Runtime are designed to use shared, dynamic IP ranges for scalability and security. Dedicated or static IP addresses are not provided; allowlisting must use Cloudflare’s published ranges or a customer-managed proxy solution.

Resolution resolution

Follow the steps below to resolve the issue:

  1. For requests sent from API Mesh Edge to a backend, allowlist all current IPv4 and IPv6 ranges published by Cloudflare. Refer to the official Cloudflare IP ranges documentation for the latest list.
  2. Review and update your allowlist periodically because these IP ranges are shared across tenants and may change over time.
  3. For I/O Runtime egress traffic, retrieve the current list using the following CLI command:
aio runtime ip-list get
  1. If your security policy requires a single fixed IP address, deploy a customer-managed proxy, NAT gateway, or egress gateway with a fixed public IP in front of your backend.
  2. Allowlist the proxy or gateway’s static egress IP on your backend.
  3. Configure API Mesh or I/O Runtime to connect to your backend through this proxy or gateway, as applicable.
  4. For additional security, mutual TLS is recommended.
  5. Verify that your backend receives traffic only from the expected allowlisted IPs or your managed proxy.

Note

I/O Runtime egress IPs are shared and are not dedicated static IPs. They may change over time.

recommendation-more-help
experience-cloud-kcs-help-kbarticles