Add trusted IPs to your integration

Who can use this: Anyone with an OAuth integration

Available on: Any Gong plan

All Gong OAuth integrations must now have trusted IP addresses configured. The configuration does not require republishing or resubmitting your app.

Add your trusted IPs

Trusted IPs are managed in a separate window on your integration, independent of your app settings.

To add trusted IPs to your integration:

1. From the left sidebar, click Admin center.

2. In the Settings tab, click API under Ecosystem.

3. In the Integrations tab, find your integration, click the More actions and select Edit trusted IPs.

4. In the Access Token and Refresh Token fields, enter the IP addresses your integration uses. Enter one address per line.

5. Click Save.

The trusted IP list is enforced as soon as you save.

The Access Token and Refresh Token fields

Gong uses two types of OAuth tokens, and trusted IPs are configured separately for each.

• Access Token: The addresses allowed to make API calls to Gong using the access token. Every API request is checked against this list at the time the token is used.

• Refresh Token: The addresses allowed to use the refresh token to obtain a new access token.

Most integrations connect from the same addresses for both, so the two lists are often identical. If your API calls and token refresh requests originate from different addresses, set each field to match the flow it governs.

Accepted formats

Each entry can be a single IPv4 or IPv6 address, a CIDR block, or a range. Enter one per line. Only public addresses are accepted. Private, loopback, link-local, and other reserved ranges are rejected, and a malformed entry is flagged inline until you correct it.

Aim for the smallest set of addresses that covers your integration's actual outbound traffic. A broad range, such as an entire cloud provider or region, offers little protection because any other customer on that provider would also pass.

If your integration does not use a fixed IP address

Serverless and autoscaling platforms, including Heroku, Vercel, Google Cloud Run, and AWS Lambda, assign outbound IP addresses dynamically. A single entry will not hold if the address changes, and your integration can start getting blocked.

We recommend one of the following:

• Route traffic through a static egress: Send the integration's outbound traffic through a fixed exit point, such as a NAT gateway or a static outbound IP add-on for your platform, then add that single address or small range to your trusted IP list. This is the most reliable option.

• Use your provider's published egress ranges: If a static egress is not possible, enter the CIDR ranges your cloud provider publishes for the specific region your integration runs in. Use only the ranges for your region, not the provider's full list.

What happens when a request is blocked

Requests from addresses not on the trusted IP list are rejected:

• Blocked API call: Returns HTTP 403 with the message "Access denied: IP address not permitted."

• Blocked token refresh: Returns the error code access_denied. This is distinct from the HTTP 400 invalid_grant returned for a revoked or invalid credential, so you can distinguish a trusted IP block from a credential issue.

A blocked refresh request does not consume your refresh token. Once you correct the trusted IP list, the integration recovers without re-authorization.

Frequently asked questions