> **Description:** Find all server endpoints for Vipps MobilePay APIs, including test and production environments, and understand their specific use cases and requirements.

> **AI agent:** Read [https://developer.vippsmobilepay.com/docs/knowledge-base/ai-tools.md](https://developer.vippsmobilepay.com/docs/knowledge-base/ai-tools.md) first. It covers keeping API keys and secrets out of generated code.

> **Full site overview:** For an overview of the entire site, read [https://developer.vippsmobilepay.com/llms.txt](https://developer.vippsmobilepay.com/llms.txt).

# Servers

The servers described here are used to send API requests to us or receive communication from us.

The servers are the same for all Vipps MobilePay APIs in all markets.

All the servers use UTC time.

**NOTE**

We may change the IP addresses for the request servers without warning.
To ensure that you are whitelisting the correct IP addresses, please use the DNS and hostnames,
and automatically update your firewall rules if there are DNS changes.
We cannot provide the IP addresses in any other way than DNS.

## API servers

**Test (MT) API server:**

`https://apitest.vipps.no`

**Production API server:**

`https://api.vipps.no`

* **Test and production environments** are completely separate--each requires its own API credentials.
* Both servers are accessible worldwide with **no IP restrictions** on the Vipps MobilePay side.
* Access control relies solely on valid **[API keys](https://developer.vippsmobilepay.com/docs/knowledge-base/api-keys.md)**.

These servers are applicable for both Vipps and MobilePay in all markets and are world accessible.

No requests to our servers are blocked on our side by IP addresses or similar.
Vipps MobilePay only relies on the API keys.

The test and production environment servers are separate and require different API credentials.

## Request servers

Vipps MobilePay can send callbacks or API requests from these servers.
These addresses are used across all markets.

| Production (Prod)     | Disaster recovery (DR)   | Test (MT)                |
| --------------------- | ------------------------ | ------------------------ |
| `callback-1.vipps.no` | `callback-dr-1.vipps.no` | `callback-mt-1.vipps.no` |
| `callback-2.vipps.no` | `callback-dr-2.vipps.no` | `callback-mt-2.vipps.no` |
| `callback-3.vipps.no` | `callback-dr-3.vipps.no` |                          |
| `callback-4.vipps.no` | `callback-dr-4.vipps.no` |                          |

The disaster recovery environment is as important as the production environment.

If you use API products that receive callbacks or other requests from Vipps MobilePay, ensure that the servers listed above are allowed in your firewall configuration.

## Landing page servers

The [landing page](https://developer.vippsmobilepay.com/docs/knowledge-base/landing-page.md) is where users enter their phone number when they pay or log in from a
browser on a computer. On a phone or tablet, the app opens instead, through universal linking.

If you validate redirect URLs, or allowlist domains in a firewall or a Content Security Policy, include the
domains below.

### Login landing page

The Login landing page is on the same domain in all markets:

| Production (Prod) | Test (MT)          |
| ----------------- | ------------------ |
| `api.vipps.no`    | `apitest.vipps.no` |

### Payment landing page

The payment landing page domain depends on the payment, so the address bar shows the right brand.
Allow all of these domains:

| Production (Prod)  | Test (MT)             |
| ------------------ | --------------------- |
| `api.vipps.no`     | `apitest.vipps.no`    |
| `pay.vipps.no`     | `pay-mt.vipps.no`     |
| `pay.mobilepay.dk` | `pay-mt.mobilepay.dk` |
| `pay.mobilepay.fi` | `pay-mt.mobilepay.fi` |

**NOTE**

When MobilePay becomes Vipps on January 12, 2027, we plan to replace `pay.mobilepay.dk` with `pay.vipps.dk`, and
`pay.mobilepay.fi` with `pay.vipps.fi`. The test domains may change earlier. If you allowlist these domains, add
the new ones. We will publish the new test domains here.

## HTTPS and TLS

All requests against our
[API platform](https://developer.vippsmobilepay.com/docs/APIs/README.md)
must use HTTPS with TLS 1.2 or higher.
TLS 1.3 is supported and recommended.

### Supported cipher suites

#### TLS 1.3

* TLS_AES_128_GCM_SHA256
* TLS_AES_256_GCM_SHA384

#### TLS 1.2 (minimum)

* TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
* TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
* TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
* TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256

Connections attempting to negotiate unsupported protocol versions or cipher suites will be rejected (e.g., `ERR_SSL_VERSION_OR_CIPHER_MISMATCH`).

## DNS lookup commands

Here are some quick commands to look up the IP addresses of all servers,
including example output at the time of writing:

Production:

```bash
$ for i in {1..4}; do dig +short callback-$i.vipps.no; done | sort -u
104.45.17.199
104.45.28.230
[...]
```

Disaster recovery:

```bash
$ for i in {1..4}; do dig +short callback-dr-$i.vipps.no; done | sort -u
13.79.229.87
13.79.231.118
[...]
```

Test:

```bash
$ for i in {1..2}; do dig +short callback-mt-$i.vipps.no; done | sort -u
104.40.249.200
104.40.250.173
[...]
```