ip allow list

mscoutermarsh · mscoutermarsh · commit b77073ab310d · 2026-02-16T12:51:45.000-05:00
diff --git a/faq.md b/faq.md
@@ -102,6 +102,12 @@ Alternatively, pass full HTML markup (starting with `<html>` and ending with `</
 
 Yes, set `full_screen: true` to capture the entire scrollable height of a page, not just the viewport. [Learn more](/parameters/full_screen/).
 
+### Do you have a list of IP addresses I can allowlist?
+
+No. Our rendering servers scale dynamically on AWS, so we are unable provide a static IP allowlist.
+
+If you're taking screenshots of protected URLs, we recommend adding a custom query parameter to the URL (for example `?hcti=1`). Then create a firewall rule (such as in Cloudflare) that allows requests when that query parameter is present.
+
 ### How do I block cookie consent banners?
 
 Set `block_consent_banners: true` when taking URL screenshots. This uses a browser extension to automatically dismiss most cookie popups. [Learn more](/guides/advanced/blocking-cookie-banners/).
@@ -288,6 +294,14 @@ Email us! **support@htmlcsstoimage.com**. We'd love to hear from you. We're expe
         "text": "Yes, set full_screen: true to capture the entire scrollable height of a page, not just the viewport."
       }
     },
+    {
+      "@type": "Question",
+      "name": "Do you have a list of IP addresses I can allowlist?",
+      "acceptedAnswer": {
+        "@type": "Answer",
+        "text": "No. Our rendering servers scale dynamically on AWS, so we don't provide a static IP allowlist. If you're taking screenshots of protected URLs, add a custom query parameter to the URL (for example ?hcti=1) and create a firewall rule (such as in Cloudflare) that allows requests when that query parameter is present."
+      }
+    },
     {
       "@type": "Question",
       "name": "How do I block cookie consent banners?",
diff --git a/getting-started/url-to-image.md b/getting-started/url-to-image.md
@@ -89,6 +89,13 @@ Supporting login is a common request, but we have chosen not to support it due t
 
 Some sites have the option of creating an "embed" of a page. This is the best option if it's available to you. You can then use the embed's HTML to generate a screenshot without login.
 
+<hr>
+## Do you have an IP allowlist?
+
+We don't provide a static IP list. Our rendering servers scale dynamically on AWS, so the source IPs can change.
+
+If you are screenshotting protected URLs, we recommend adding a custom query parameter to the URL (for example `?hcti=1`) and creating a firewall rule (such as in Cloudflare) that allows requests when that query parameter is present.
+
 <hr>
 ## Need help getting started?
 
