From 32877972e89f2ebe71fba2e926217c12f9326372 Mon Sep 17 00:00:00 2001 From: Federico Coppede Date: Tue, 20 Jan 2026 12:10:57 -0300 Subject: [PATCH] docs: created egress IPs page for Zitadel Cloud (#11376) Added the list of egress IPs per region for Zitadel Cloud outgoing requests from Actions/IDP connections/SMTP/SMS/etc. --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Florian Forster --- docs/docs/guides/manage/cloud/egress.md | 47 +++++++++++++++++++++++++ docs/sidebars.js | 1 + 2 files changed, 48 insertions(+) create mode 100644 docs/docs/guides/manage/cloud/egress.md diff --git a/docs/docs/guides/manage/cloud/egress.md b/docs/docs/guides/manage/cloud/egress.md new file mode 100644 index 000000000..b7acba37a --- /dev/null +++ b/docs/docs/guides/manage/cloud/egress.md @@ -0,0 +1,47 @@ +--- +title: ZITADEL Cloud Egress IP Addresses +sidebar_label: Egress IPs +description: A list of static IP addresses ZITADEL Cloud uses to make outbound connections to your services. +--- + +When configuring your firewall or network security groups, you may need to allow traffic **from** ZITADEL Cloud to your internal infrastructure. + +This page lists the static Egress (outgoing) IP addresses used by ZITADEL Cloud regions. + +## When do I need this? + +You need to allowlist these IP addresses if you use features where ZITADEL initiates a connection to your systems. This is commonly required for the following scenarios: + +### [Identity Providers & Federation](/docs/guides/integrate/identity-providers/introduction) +If you are federating an external Identity Provider (IdP) that sits behind a firewall: +* **LDAP / Active Directory:** When ZITADEL connects to your LDAP server (typically port `636` for LDAPS). +* **OIDC / OAuth:** When ZITADEL connects to your IdP for: + * **Discovery:** Fetching configuration from `/.well-known/openid-configuration`. + * **Token Exchange:** Exchanging the authorization code at the `token_endpoint`. + * **User Info:** Retrieving user details from the `userinfo_endpoint`. + * **Keys:** Fetching signing keys from the `jwks_uri`. +* **SAML:** If ZITADEL needs to fetch the `metadata.xml` or artifact resolution services from an internal SAML IdP. + +### [Notification Providers](/docs/guides/manage/customize/notification-providers) +* [**SMTP:**](/docs/guides/manage/customize/notification-providers#smtp-providers) If you configured a custom SMTP sender pointing to your own mail server. +* [**Webhook / HTTP provider:**](/docs/guides/manage/customize/notification-providers#webhook--http-provider) If you use a custom gateway for SMS or Emails. + + +### Custom Logic +* **[Actions V1](/docs/concepts/features/actions)** +* **[Actions V2](/docs/concepts/features/actions_v2)** + +## IP Addresses by Region + +We recommend allowing the IP address corresponding to the region where your ZITADEL instance is hosted. + +| Region | Egress IP Address | +| :--- | :--- | +| **Switzerland** | `34.65.158.196` | +| **Europe** | `34.107.19.72` | +| **United States** | `34.69.146.246` | +| **Australia** | `34.87.243.23` | + +:::tip +To find out which region your ZITADEL Cloud instance is running in, check the [ZITADEL Customer Portal](https://zitadel.com/admin/instances). +::: \ No newline at end of file diff --git a/docs/sidebars.js b/docs/sidebars.js index 14a7617df..27a1b7d5d 100644 --- a/docs/sidebars.js +++ b/docs/sidebars.js @@ -714,6 +714,7 @@ module.exports = { collapsed: true, items: [ "guides/manage/console/console-overview", + "guides/manage/cloud/egress", { type: "category", label: "Customer Portal",