Network access and allow-listing

Every call BatchRouter makes to your endpoint, from the connection test to batch work, is an outbound HTTPS request from the BatchRouter API. This page covers where those requests come from, what your network must allow, and what to do when the connection test times out.

If the portal says your endpoint did not answer within 10 seconds, start with When the connection test times out.

Where requests come fromCopy Anchor Link

BatchRouter runs on Cloudflare Workers, so requests to your endpoint leave from Cloudflare's network. Cloudflare publishes the address ranges it uses at cloudflare.com/ips, and also through its API.

• BatchRouter has no fixed IP address of its own. The source address can be any address in Cloudflare's ranges, and it can change from one request to the next.
• Cloudflare says its ranges are shared across services and may change over time. If you allow-list them, check the list now and then.
• The source addresses don't point to a country. A rule that admits only one country's address space, such as a geo-IP filter, can block BatchRouter even though the work is for that country.

What your endpoint must supportCopy Anchor Link

Redirects. BatchRouter follows up to 5 redirects. Each target must pass the same rules as the base URL (HTTPS, public hostname). When a redirect goes to a different origin, BatchRouter drops the Authorization header before following it, so the other host never sees your key.

TimeoutsCopy Anchor Link

A request fails when your endpoint hasn't answered in time. The limit covers connecting, the TLS handshake and reading the response, so a server that accepts the connection and then stalls fails the same way as one that never answers.

The connection test reads at most 4 MiB of your /v1/models list. If your list is larger, put the models you added near the start.

What the checks callCopy Anchor Link

BatchRouter sends nothing else during onboarding. The first two calls make up the Test your endpoint step of the onboarding checklist. The third belongs to the tier self-test, a later step.

The checks run in that order and stop at the first failure. When GET /v1/models fails, the portal never gets as far as /v1/batches, so a failure at the first call tells you nothing about the second. A chat-completions-only lane gets no /v1/batches call.

None of the checks creates work, and no customer is billed. The self-test request costs a handful of tokens on your own endpoint.

What BatchRouter calls when it sends you workCopy Anchor Link

On an OpenAI Batch API lane, a batch uses these calls, all with the same key:

• POST /v1/files to upload the input file, then POST /v1/batches to create the batch
• GET /v1/batches/{id} to poll, and GET /v1/batches/{id}/results for partial results when you turn them on
• GET /v1/files/{id}/content to download the output and error files
• POST /v1/batches/{id}/cancel to cancel

The exact shapes are in the Provider API. Direct requests go to POST /v1/chat/completions.

What to allow-listCopy Anchor Link

If your endpoint sits behind a firewall, a web application firewall or an API gateway that filters by source address:

1. Allow inbound HTTPS (port 443) from Cloudflare's published IP ranges, for both IPv4 and IPv6.
2. Allow the paths listed above, and the Authorization header, through to your server.
3. Don't rate-limit or challenge these requests as bots. A browser challenge can't be answered by a server-to-server call, and the test fails.
4. Make sure your server answers within the timeouts above, including the TLS handshake.

BatchRouter can't promise that this covers every source address it will ever use, because Cloudflare decides which address a request leaves from. If an allow-list of Cloudflare's published ranges is not enough for your security policy, write to us before you spend time on it.

What BatchRouter can't offerCopy Anchor Link

• A fixed or dedicated source IP address, or a short list of addresses that stays the same.
• A private link, VPN, peering or private-network connection to your endpoint.
• Client certificates (mutual TLS) on requests to you.
• Calls to an IP address, a non-public hostname or plain HTTP.

Authentication is the bearer key. Create a dedicated, revocable key for BatchRouter and rotate it if you suspect it leaked.

When the connection test times outCopy Anchor Link

"your-host did not answer within 10 seconds" means no response arrived in time. The portal doesn't say at which step the connection stalled. Try this in order:

1. From a machine outside your own network, for example a cloud server or a phone on mobile data, run curl -sS -m 10 -H "Authorization: Bearer <key>" https://<your-host>/v1/models. If it also hangs, the block sits in front of your server, and BatchRouter isn't the cause.
2. Check whether the TCP connection opens at all. If connecting to port 443 times out, a firewall, a geo-IP filter or an IP allow-list is dropping the packets. Allow Cloudflare's ranges as described above.
3. If the connection opens and the TLS handshake fails, check the certificate chain. Serve the full chain, including intermediate certificates.
4. If you get an HTTP response, the portal shows its status and a hint instead of a timeout. See the usual fixes in the endpoint test.

Once the allow-list is in place, run Test your endpoint again from the portal.