Networking and firewalls

Which addresses Conviro uses to reach your store (for allowlists), which Conviro hosts your store and your shoppers' browsers must reach, and what to check when a WAF or CDN sits in front of Magento. Plan §20 item 16, Phase F "static outbound IP strategy".

Inbound to your store: where Conviro calls from

Conviro's API makes every call to your store — live product / price / stock / order reads, connection checks, the nightly product pull, order actions, and the webhooks to /conviro/webhook/receive. In production these run in the API containers (two replicas) on the production host, next to Conviro's other application containers (web, MCP) on the same host.

Measured source address: 167.235.12.75 (IPv4).


Measured	2026-09-24 10:38–10:39 UTC
Method	Read-only commands over the production SSH helper (`scripts/ops/prod_ssh.py`): `curl -4 https://api.ipify.org` on the API host, and `fetch('https://api.ipify.org')` from inside both running API containers (`docker-api-832`, `docker-api-833`). All three answered `167.235.12.75`; `hostname -I` on the host lists `167.235.12.75` as its own interface address (plus Docker bridge addresses), i.e. the containers leave through the host's own address, not a shared NAT pool.
IPv6	None. `curl -6 https://api6.ipify.org` on the host found no IPv6 route; `fetch` from the API container failed with `ENETUNREACH`. Conviro reaches your store over IPv4 only — make sure your store's hostname has an A record.
No separate worker	The chat pipeline's live reads ran in the same API containers: the optional Temporal worker service (`worker` in `docker/docker-compose.yml`, `WORKER_REPLICAS` default 0) was not running. A worker started on the same server leaves through the same host address; re-measure if it is ever placed elsewhere.

This is a measurement, not a contract. The address belongs to the server Conviro's API runs on today; it changes if Conviro moves that server, and there is no published change-notification process for it yet. If you allowlist it, also keep an eye on the Integration Health card (a block shows up as Action required: Connection / Authentication or as live reads failing) and ask Conviro support before relying on it for a hard block.

What to allow on your side

From	To	Why
`167.235.12.75` (as measured)	`https://<your store>/rest/V1/…` and `/rest/<store code>/V1/…`	Live reads (products, prices, stock / MSI, store config, orders, carts, customers) and, if enabled, order actions. OAuth 1.0a signed.
same	`https://<your store>/conviro/webhook/receive` (POST)	Conviro's signed notifications (lead / contact / session events).

Conviro only calls your store over https and only when the hostname resolves to a public address; it refuses plain http and private addresses before sending any credentials.

Outbound from your store: what Magento must reach

Host	Port	Used by	Required
`api.conviro.io`	443	Event delivery (cron), connect / register / health / version calls (admin, cron)	yes
`repo.conviro.io`	443	Composer install and updates (from wherever you run Composer)	for installs/updates

The shopper's browser (and the admin's browser during Connect to Conviro) additionally needs cdn.conviro.io (widget bundle), api.conviro.io (widget API, including wss://) and app.conviro.io (approval page — admin only).

api.conviro.io, app.conviro.io, cdn.conviro.io and repo.conviro.io are served through Cloudflare: on 2026-09-24 they resolved to Cloudflare anycast addresses (104.21.58.178, 172.67.162.104, 2606:4700:3037::6815:3ab2, 2606:4700:3037::ac43:a268). These are shared and can change at any time — allow the hostnames (an egress proxy with SNI/host rules), not these IPs. If your firewall only accepts IP ranges, use Cloudflare's published ranges.

Every request the module makes to Conviro carries the User-Agent Conviro-Magento/<module version> (Magento <version>; +https://useconviro.com) (1.4.1). An egress proxy should pass it through unchanged, so Conviro can recognise the module's calls. If Conviro's network protection challenges your server anyway, the Connection row says Conviro's network protection blocked this server — see Troubleshooting.

WAF and CDN in front of Magento

If Cloudflare, another CDN, a WAF or a load balancer sits in front of your store:

Let Conviro's REST calls through. Bot-fight / challenge modes return an HTML challenge instead of JSON; rate limits on /rest/* can answer 429. An allow rule for 167.235.12.75 on /rest/* and /conviro/webhook/receive is the usual fix. Symptoms: live answers fail, Authentication shows "Conviro's last call to this store failed", or Conviro's alerts see 401/403/429 bursts.
Do not rewrite request bodies or strip headers on /conviro/webhook/receive: the signature covers the exact body, and the header X-Webhook-Signature must arrive unchanged. The OAuth Authorization header on /rest/* must also pass through unchanged.
TLS terminated before Magento (signing note). OAuth 1.0a signs the full request URL including the scheme. When a proxy terminates HTTPS and forwards plain http without telling Magento, Magento verifies the signature against http://… and refuses one made for https://…. Conviro tries both automatically (it signs as http while still sending over https) and records which worked; the clean fix is to make the proxy send the header configured in web/secure/offloader_header (default X-Forwarded-Proto: https) so Magento knows the request was HTTPS. Until one of the two works the store stays on the legacy bearer token, and the Integration Health Authentication row says so.
Redirects. Conviro treats a redirecting store URL as a failure (a 3xx is counted as a failed live read). Register the final https base URL. Since 2026-09-26 Conviro also never follows a redirect on a webhook (/conviro/webhook/receive): a 3xx there is a failed delivery, and after 5 in a row over at least 15 minutes the webhook is paused and shown on the Conviro dashboard (Delivery health), with Verify and resume. Module 1.3.x always answered it with a redirect (no CSRF exemption) — update to 1.4.1.
Recognising Conviro. Webhooks from Conviro carry the User-Agent Conviro-Webhooks/1.0 (+https://useconviro.com) (since 2026-09-26). It is a label, not a credential: allow by IP and path, and let the signature (X-Webhook-Signature) authenticate. A challenge page your WAF returns is recorded by Conviro as challenge (not as a bad signature) and paused after 24 hours of failures.
Outbound from Magento. An egress proxy must allow api.conviro.io:443; the setup wizard's step 1 tests exactly that (any HTTP answer = route open).