If you require an allowlist for outgoing requests from your servers, you can fetch the list of IP addresses that the Paddle API uses.
The IP addresses returned are for the environment you make the request in: production base URL returns production IPs, sandbox base URL returns sandbox IPs.