Great question — there isn’t a single static IP to whitelist for “Prefect services” because it depends on what direction the traffic is going and how you’re running Prefect. Quick guide: - If your network needs to reach Prefect Cloud (outbound from you to Prefect): there are no fixed IPs to allowlist. Prefect Cloud is fronted by Cloudflare and endpoints are domain-based over HTTPS. Most users allowlist domains (e.g., allow outbound to Prefect Cloud over port 443) rather than IPs. - If Prefect Cloud needs to reach your systems (inbound to you from Prefect): - Serverless/hosted runs or Cloud webhooks: static egress IPs are not publicly documented. Use webhook signing where possible, or contact Prefect Support for options on static egress on eligible plans. - User-hosted workers (Kubernetes, ECS, VM, etc.): traffic to your resources originates from your own infrastructure’s IPs — so you’d allowlist your worker nodes’ egress IPs, not Prefect Cloud. If you’re trying to limit who can access your Prefect Cloud workspace (ingress to Prefect Cloud), we do support an IP allowlist feature that restricts access by client IP. Docs: Secure access by IP address Could you share a bit more so I can give precise guidance? - Are you whitelisting outbound from your network to Prefect Cloud, or inbound from Prefect to your systems? - Are you using Prefect Serverless/hosted workers, or running your own workers? - Which Cloud region is your workspace in? If you specifically need static egress IPs from Prefect Cloud to your services, I can loop in Support to discuss options for your account and region.