Skip to main content
View as Markdown (opens in a new tab)

Servers

The servers described here are used to send API requests to us or receive communication from us.

The servers are the same for all Vipps MobilePay APIs in all markets.

All the servers use UTC time.

Note

We may change the IP addresses for the request servers without warning. To ensure that you are whitelisting the correct IP addresses, please use the DNS and hostnames, and automatically update your firewall rules if there are DNS changes. We cannot provide the IP addresses in any other way than DNS.

API servers​

Test (MT) API server:

https://apitest.vipps.no

Production API server:

https://api.vipps.no

  • Test and production environments are completely separate—each requires its own API credentials.
  • Both servers are accessible worldwide with no IP restrictions on the Vipps MobilePay side.
  • Access control relies solely on valid API keys.

These servers are applicable for both Vipps and MobilePay in all markets and are world accessible.

No requests to our servers are blocked on our side by IP addresses or similar. Vipps MobilePay only relies on the API keys.

The test and production environment servers are separate and require different API credentials.

Request servers​

Vipps MobilePay can send callbacks or API requests from these servers. These addresses are used across all markets.

Production (Prod)Disaster recovery (DR)Test (MT)
callback-1.vipps.nocallback-dr-1.vipps.nocallback-mt-1.vipps.no
callback-2.vipps.nocallback-dr-2.vipps.nocallback-mt-2.vipps.no
callback-3.vipps.nocallback-dr-3.vipps.no
callback-4.vipps.nocallback-dr-4.vipps.no

The disaster recovery environment is as important as the production environment.

If you use API products that receive callbacks or other requests from Vipps MobilePay, ensure that the servers listed above are allowed in your firewall configuration.

Landing page servers​

The landing page is where users enter their phone number when they pay or log in from a browser on a computer. On a phone or tablet, the app opens instead, through universal linking.

If you validate redirect URLs, or allowlist domains in a firewall or a Content Security Policy, include the domains below.

Login landing page​

The Login landing page is on the same domain in all markets:

Production (Prod)Test (MT)
api.vipps.noapitest.vipps.no

Payment landing page​

The payment landing page domain depends on the payment, so the address bar shows the right brand. Allow all of these domains:

Production (Prod)Test (MT)
api.vipps.noapitest.vipps.no
pay.vipps.nopay-mt.vipps.no
pay.mobilepay.dkpay-mt.mobilepay.dk
pay.mobilepay.fipay-mt.mobilepay.fi
Note

When MobilePay becomes Vipps on January 12, 2027, we plan to replace pay.mobilepay.dk with pay.vipps.dk, and pay.mobilepay.fi with pay.vipps.fi. The test domains may change earlier. If you allowlist these domains, add the new ones. We will publish the new test domains here.

HTTPS and TLS​

All requests against our API platform must use HTTPS with TLS 1.2 or higher. TLS 1.3 is supported and recommended.

Supported cipher suites​

TLS 1.3​

  • TLS_AES_128_GCM_SHA256
  • TLS_AES_256_GCM_SHA384

TLS 1.2 (minimum)​

  • TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
  • TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  • TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
  • TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
  • TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
  • TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
  • TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
  • TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256

Connections attempting to negotiate unsupported protocol versions or cipher suites will be rejected (e.g., ERR_SSL_VERSION_OR_CIPHER_MISMATCH).

DNS lookup commands​

Here are some quick commands to look up the IP addresses of all servers, including example output at the time of writing:

Production:

$ for i in {1..4}; do dig +short callback-$i.vipps.no; done | sort -u
104.45.17.199
104.45.28.230
[...]

Disaster recovery:

$ for i in {1..4}; do dig +short callback-dr-$i.vipps.no; done | sort -u
13.79.229.87
13.79.231.118
[...]

Test:

$ for i in {1..2}; do dig +short callback-mt-$i.vipps.no; done | sort -u
104.40.249.200
104.40.250.173
[...]
Last updated on