# IP allowlist
URL: https://docs.clearly-ai.com/docs/ip-allowlist
Description: Allow Clearly AI to reach IP-restricted tools and APIs.
Clearly AI calls external systems from static egress IPs. If a connected tool restricts inbound traffic by source IP, allowlist the IPs Clearly AI provides during onboarding.

This is commonly needed for Jira, internal APIs, self-hosted tools, proxies, and network controls such as Zscaler.

## Add Clearly AI to an external allowlist [#add-clearly-ai-to-an-external-allowlist]

1. Open the external system's IP allowlist or firewall rule page.
2. Add each Clearly AI egress IP.
3. If the system asks for CIDR notation, use `/32` for a single IP address.
4. Save the rule.
5. In Clearly AI, open **Organization settings**, select **Integrations**, and click **Configure** on the integration's card. On the **Connections** tab, click **Edit authentication**, then click **Apply and test** to rerun the connection test.

## Browser access allowlisting [#browser-access-allowlisting]

If your company uses a secure web gateway such as Zscaler, you might need to add an allowlist rule before you can open Clearly AI in a browser.
Ask your Clearly AI contact for the URLs to allowlist for your tenant (typically, `https://{your-company-name}.clearly-app.com`, subdomains, a global OAuth frontend, and an authentication URL).

In Zscaler, this is usually a URL allowlist or cloud app control rule for the tenant and auth domains. This is separate from the static egress IP allowlist used when Clearly AI connects outbound to your tools.

## FAQs [#faqs]

<Accordions>
  <Accordion title="Why does the integration test return 403 or say the IP is not listed?">
    Confirm the exact egress IP from Clearly AI was added to the provider allowlist. For CIDR fields, use `/32`.
  </Accordion>

  <Accordion title="What if the provider has multiple environments?">
    Add the IPs to the environment Clearly AI connects to, such as production Jira, sandbox Jira, or a specific internal API gateway.
  </Accordion>

  <Accordion title="What if the rule was added but the test still fails?">
    Check whether your proxy, WAF, or Zscaler policy has a separate rule path from the application-level allowlist.
  </Accordion>
</Accordions>

## Related [#related]

* [Integrations](https://docs.clearly-ai.com/docs/integrations)
* [Deployment patterns](https://docs.clearly-ai.com/docs/deployment-patterns)