Skip to main content

Configuring network access with IP allowlists


You can access Bitrise virtual machines from behind a private network or a firewall. To do so, allowlist our build machine IP addresses in your network.

Our datacenters are behind a set of public static IP addresses, with the virtual machines having their own internal subnets behind these addresses. Depending on your company security policy, you may need to allowlist the public IP addresses to be able to access the build machine: IP address ranges for the Bitrise build machines.

Similarly, the Bitrise background workers powering UI and related control plane, configuration management, signaling to your services are accessible at a set of static IP addresses. Allowlisting these addresses can ensure you can still receive build status updates or that Bitrise can access the bitrise.yml file: IP address ranges for Bitrise backend workers of your app.

IP address ranges for the Bitrise build machines

For most users, who host their repositories on cloud-based service providers, there is no need for any network configuration to be able to use Bitrise. All we need is permission to access the repository and for that, an SSH key or an access token is enough.

However, your company security policy might not allow unknown and unauthorized IP addresses to communicate with the servers where your code is being stored - either on your own datacenter or in a private cloud. In that case, Bitrise won’t work unless the relevant IP addresses are added to your allow list.

You will see IP addresses from the following ranges as source when your Bitrise build machines reach out to your services like Git to download your source code, or call into your test backend services, or any other services you run outside Bitrise that are required to be reached as part of your CI workflow.

Allowlist the entire subnet

If the provided public IP address is a subnet, you need to allow the entire subnet on your network! For example, means all IP addresses between and (,,, and so on, all the way to and including have to be allowlisted.

Table 1. External and internal IP address ranges for the build machines

Stack type

Public IP

Xcode stacks and and and

Linux/Docker stacks

IP address ranges for Bitrise backend workers

Bitrise backend workers are operating behind firewalls and NAT gateways. There are some use cases when our backend workers need to reach your services.

These addresses may be relevant if you use self-hosted Git services or store your bitrise.yml file in the repository. In this way Bitrise can, for example, access the bitrise.yml file, or send build status updates on commits and pull requests in a self-hosted repository.

Table 1. Static IP addresses for the Bitrise website and its background workers

IP address ranges

Document changelog

April 2024

Added the range to the IP ranges of both the build machines and the backend workers, which will utilize the new IP range after the 20th of May, 2024.

October 2022

Significantly increased the Linux/Docker stacks IP range.