IP addresses are the list of IP addresses where Paddle sends webhooks from. Add them to an allowlist on your webhook server so you can reject requests that come from anywhere else.
Addresses differ between sandbox and live accounts, and the endpoint returns the ones for the base URL you call: sandbox-api.paddle.com returns sandbox addresses, api.paddle.com returns live addresses. Allowlist both if you run a sandbox integration alongside your live one.
Responses hold ipv4_cidrs, a list of IPv4 addresses in CIDR notation.
Paddle's addresses change rarely, but they do change. Fetching them keeps your allowlist current, where a hardcoded list quietly goes stale.
An allowlist tells you a request reached you from Paddle's network. It doesn't tell you the payload is genuine, so verify the Paddle-Signature header on every webhook too.