Add Static Outbound IP Addresses

Enabling this feature can result in slower workspace startup times, because workspaces with static IPs are configured with custom network routing.

Agentforce Vibes IDE workspaces can route outbound traffic through a fixed set of static IP addresses. IP allowlisting is an opt-in feature that Salesforce needs to enable for your organization. When active, all outbound traffic from newly created workspaces exits through these IPs.

If your organization enforces IP-based access restrictions, such as login IP ranges, add these IPs to your allowlist.

All Agentforce Vibes IDE workspaces share the static outbound IP addresses and don’t uniquely identify a specific customer, organization, or workspace.

  • Global IP Sharing: Adding these addresses to an allowlist permits network-level connection requests from all Agentforce Vibes IDE workspaces, including those outside your organization.
  • App-Level Protection Required: IP allowlisting controls network connectivity only—it doesn’t grant data access. Continue to protect your endpoints with appropriate app-level authentication and valid Salesforce authorization checks.

Before you add other IPs, you must first add the outbound IP of your IDE. Use curl ifconfig.me to retrieve the local IP and add it to the allowlist, as explained in these steps.

You can add an IP range for a user profile by:

  1. Using the setup option.
  2. Editing the .profile-meta.xml file for a profile.
  1. Click Setup gear icon.
  2. In the Quick Find box, enter Agentforce Vibes IDE.
  3. Verify that the Enable Static IPs option is enabled.
  4. In the Quick Find box, enter Profiles, and select Profiles under Users.
  5. From the list of user profiles, select an Agentforce-Vibe-IDE-user profile. For example, System Administrator.
  6. Scroll down to the Login IP Ranges option and click New.
  7. To add an IP range, enter the same IP address in the Start IP Address and End IP Address boxes.
  8. Enter a description. For example, AFV IDE Static IP Address.
  9. Save your changes. To add more IP addresses, repeat the process.

You can manage login IP ranges as profile metadata, which is useful for automation or for CI (Continuous Integration) and CD (Continuous Deployment) pipelines. Add these IP ranges to your .profile-meta.xml file as given in this example.

After you’re done updating the IP ranges, Deploy the metadata to Your org by using the sf project deploy start command.

The list of IPs doesn’t undergo frequent changes. In the event of a planned change, customers are notified before any changes.

Yes. While your workspace currently uses a single IP, we can reassign it to any IP on our list at any time for maintenance or capacity. We recommend allowlisting the entire IP list rather than just your current one to avoid the risk of an immediate, unannounced loss of connectivity.

IP allowlisting provides an extra layer of defense, but Salesforce still fully enforces all standard authentication methods. The standard authentication methods include usernames, passwords, MFA (multi-factor authentication), and Single Sign-On (SSO), alongside authorization controls like profiles, permission sets, and sharing rules.

IP allowlisting alone isn’t enough because multiple organizations share those IPs. Instead, Salesforce authentication secures your data by making sure that only authorized users can log in, no matter where they connect from.