Servers
This is applicable for both Vipps and MobilePay.
Vipps MobilePay has servers for you to use when making API calls, and for us to make API calls to merchants (e.g., callbacks). The servers are the same for all APIs in all markets. The Vipps MobilePay servers all use UTC time.
We may change the IP addresses for the request servers without warning. To ensure that you are whitelisting the correct IP addresses, please use the DNS and hostnames, and automatically update your firewall rules if there are DNS changes. We cannot provide the IP addresses in any other way than DNS.
API servers
You will use these servers when making API requests to Vipps MobilePay.
The test and production environment servers are separate and require different API credentials. These server addresses are applicable in all markets.
Production server: https://api.vipps.no
Test (MT) server: https://apitest.vipps.no
The servers are world accessible. Vipps MobilePay only relies on the API keys, and no requests to our servers are blocked on our side by IP addresses or similar.
Request servers
Vipps MobilePay can send callbacks or API requests from these servers in all markets.
| Production (Prod) | Disaster recovery (DR) | Test (MT) |
|---|---|---|
callback-1.vipps.no | callback-dr-1.vipps.no | callback-mt-1.vipps.no |
callback-2.vipps.no | callback-dr-2.vipps.no | callback-mt-2.vipps.no |
callback-3.vipps.no | callback-dr-3.vipps.no | |
callback-4.vipps.no | callback-dr-4.vipps.no |
The disaster recovery environment is as important as the production environment.
For API products where we make requests to your servers, please make sure that these request servers are allowed through firewalls, etc.
Landing page servers
Users will use the landing pages to log in to Vipps MobilePay or authorize a Vipps MobilePay payment from their desktop computer.
The URLs from which we serve the landing page are specific to the market region in order to show the correct brand in the address bar. The landing page domains are:
| Production (Prod) | Test (MT) |
|---|---|
api.vipps.no | apitest.vipps.no |
pay.vipps.no | pay-mt.vipps.no |
pay.mobilepay.dk | pay-mt.mobilepay.dk |
pay.mobilepay.fi | pay-mt.mobilepay.fi |
See Landing page for information about the landing page.
HTTPS and TLS
All URLs used with our API platform must be HTTPS and use TLS 1.2.
We support the following cipher suites for TLS 1.2:
- TLS_AES_128_GCM_SHA256
- TLS_AES_256_GCM_SHA384
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
Other cipher suites will result in errors like ERR_SSL_VERSION_OR_CIPHER_MISMATCH.
DNS lookup commands
Here are some quick commands to look up the IP addresses of all servers, including example output at the time of writing:
Production:
$ for i in {1..4}; do dig +short callback-$i.vipps.no; done | sort -u
104.45.17.199
104.45.28.230
[...]
Disaster recovery:
$ for i in {1..4}; do dig +short callback-dr-$i.vipps.no; done | sort -u
13.79.229.87
13.79.231.118
[...]
Test:
$ for i in {1..2}; do dig +short callback-mt-$i.vipps.no; done | sort -u
104.40.249.200
104.40.250.173
[...]