Toast has announced new network addresses for outbound API requests, requiring an access-list update from gift-card integrators that restrict incoming traffic by its source.

The September 18 developer notice [S01] explicitly covers gift-card, loyalty and tender APIs, alongside webhook messages. It lists nine production addresses and four sandbox addresses.

The data behind the story

Published source-address lists differ by environment

Toast September 18, 2026 notice, matched to the complete developer guide.

Listed IPv4 source addresses
Source
Toast developer guide: source IP addresses

Count of unique addresses in each explicitly published list. Shared across webhook, gift-card, loyalty and tender requests. Not traffic, request volume, capacity, outage counts or a before-and-after expansion. Allowlisting does not replace request authentication.

Show data tableHide data table
Scroll left or right to see all columns
Published source-address lists differ by environment (Listed IPv4 source addresses)
CategoryListed IPv4 source addresses
Production9 Listed IPv4 source addresses
Sandbox4 Listed IPv4 source addresses

Toast says integrations must allow every address for the relevant environment to continue receiving requests without interruption. An incomplete list could produce intermittent failures because some requests would arrive from permitted addresses while others would be blocked. The notice does not report an actual outage or affected transaction total.

The company's supporting technical documentation [S02] explains that these integrations share the same address list within each environment. There is no dedicated address assigned to an individual integration or request type.

The documentation also distinguishes network access from authentication. Allowing an address through a firewall does not replace verification of webhook signatures or the credentials accompanying outbound API requests.

For gift-card providers connected to restaurant systems, the change concerns the delivery path for platform requests. Toast's announcement does not specify a migration deadline or say that card balances or card terms are changing.