Rhythms outbound IP ranges for allowlisting
When Rhythms connects out to one of your systems — a database, an on-premises API, a self-hosted MCP server, a Jira Data Center instance — the connection originates from static addresses that Rhythms owns. If that system restricts inbound traffic by source IP address, add both ranges below to its allowlist.
These are outbound ranges only. They are the addresses Rhythms connects from. Nothing here opens inbound access to your Rhythms workspace.
The ranges
Both ranges are required. Traffic can originate from either one.
| Range |
|---|
20.72.177.36/30 |
104.40.3.64/30 |
Hostname allowlist or IP allowlist: which one you need
A hostname allowlist and an IP allowlist are different controls. Which one you need depends on the direction of the traffic and on what the filtering system can see.
- Your people reaching Rhythms. A web proxy or firewall that filters your users' outbound web traffic by hostname should allow
https://app.rhythms.ai/**. It is inspecting requests leaving your network, so it can match a hostname, and the IP ranges above are irrelevant to it. - Rhythms reaching your system. A firewall in front of a database, an internal API or a self-hosted MCP server sees an inbound connection with a source IP address. There is no hostname for it to match, so it needs the IP ranges above.
The two controls are independent. Allowing the hostname does not allow the IP ranges, and allowing the IP ranges does not allow the hostname. Cloud services that Rhythms connects to through their public APIs — Google Sheets, HubSpot, Linear, Atlassian Cloud and similar — normally need neither; the ranges matter when your system sits behind a firewall you control.
If these ranges ever change
The ranges above are static and are not rotated. If Rhythms ever needs to change them, affected workspace administrators are notified at least 30 days in advance, and the old and new ranges run in parallel through the transition so a correct allowlist never stops working.
Frequently asked questions
Do I really need both ranges? Yes. Rhythms may connect from either range, and an allowlist with only one of them will fail intermittently.
Does allowlisting these ranges expose my Rhythms workspace? No. The ranges describe where Rhythms connects from when it reaches out to your systems. They do not open any path into your workspace, which is reached only through your users' sign-ins.
My connector works without allowlisting. Do I still need this? Only if the system Rhythms connects to filters inbound traffic by source IP. If the connector already works, that system is not filtering, and no change is needed.