WAVE Anchor — the published surface
IP addresses and egress policy for customer network and security teams. All data here is measured from live infrastructure — not planned or aspirational.
Inbound — Cloudflare anycast
All wave.online domains resolve through a Cloudflare anycast pair. These are the IPs your firewall rules should reference for inbound traffic from WAVE services.
Protocol: HTTP/2 and HTTP/3 (QUIC). Anycast routing means traffic reaches the nearest Cloudflare edge — the source IP may vary by region.
| IP addresses | Domain | Note |
|---|---|---|
172.66.40.86 / 172.66.43.170 | wave.online | Cloudflare anycast — primary + secondary |
172.66.40.86 / 172.66.43.170 | www.wave.online | Same anycast pair |
172.66.40.86 / 172.66.43.170 | api.wave.online | Same anycast pair |
172.66.40.86 / 172.66.43.170 | status.wave.online | Same anycast pair |
172.66.40.86 / 172.66.43.170 | gateway.wave.online | Same anycast pair |
172.66.40.86 / 172.66.43.170 | runtime.wave.online | Same anycast pair |
172.66.40.86 / 172.66.43.170 | review.wave.online | Same anycast pair |
172.66.40.86 / 172.66.43.170 | app.wave.online | Same anycast pair |
Inbound — Dedicated IPs
These services run on dedicated inbound IPs (not behind Cloudflare anycast). Allow-list these for service-specific integrations.
| IP address | Purpose | Host |
|---|---|---|
37.16.9.159 | SRT media ingress | Fly dedicated |
168.220.82.233 | bridge-recv-grid | Fly dedicated |
137.66.2.38 | sftp-stripe | Fly dedicated |
Outbound — Egress spine
WAVE's outbound egress is pinned to a single spine. If your infrastructure requires allow-listing WAVE-originated traffic, use these IPs.
Pinned egress IP: 209.71.104.234 (IPv4) + IPv6 (see feed).
Machine-readable feed: https://anchor.wave.online/ips/egress.txt
Change policy: 7-day advance notice + dual-run window. Any egress IP change is announced on the feed at least 7 days before the old IP is retired.
What you get
| Capability | Availability |
|---|---|
| Published surface contract + live machine-readable egress feed + 7-day change-notice policy | Free — included for every WAVE customer |
| Static Egress: a dedicated set of pinned IPs for your webhooks, reserved per tenant | Enterprise |
| Guaranteed Delivery: signed webhooks + pinned egress + delivery receipts | Enterprise |
| Private Interconnect: your traffic never touches the public internet | Enterprise |
The free tier is the contract on this page, kept honest by continuous measurement. Enterprise capabilities are provisioned per account — your account team turns them on, nothing here changes without notice.
Security guidance
IP pinning is defense-in-depth. It is not a substitute for cryptographic verification. Always verify webhook signatures (HMAC) as the primary control — IP addresses can change, rotate, or be shared.
Receipts & verification
Every data point on this page is measured from live infrastructure and re-verified continuously by an automated drift audit. If a published address ever changes, the change is announced at least 7 days in advance and the old and new addresses serve side by side during the transition — so a firewall rule you add today keeps working through any future change.
The machine-readable feed above is generated by the same measurement path your firewall consumes — not a hand-maintained list.