Have been successfully calling the Google Places API from an apex class via httpRequest callout. The callout works as expected but would like to lock down the API via HTTP Referrer restriction. As soon as I attempt to lock down the service via http referrers the callout fails. Believe this is due to Salesforce making the httpRequest callout via an internal server address.

After locking down the API I receive the following message from the google service. '"{"status":"REQUEST_DENIED","results":[]} which indicates the callout is being blocked.

Does anyone know how I can find the internal Salesforce server address that is making this callout so I can restrict the Google Places API key usage?

1 Answer 1


Salesforce has something like a 436,736 (436,702 usable) IP addresses as of the time of this answer. You'll have to figure out which ones are applicable to you, if you want to place restrictions. Hopefully, you can specify very large IP ranges, or you'll have a pretty hard time figuring out which ones you need. At minimum, you will probably need to deal with the /14 address, which is 262,144 IP addresses by itself. If you're really worried about your key being "borrowed", you might want to just encrypt it, which will limit access to just the developers. See Storing Sensitive Data for more information.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .