# Troubleshooting Overview (/docs/guides/troubleshooting/troubleshooting-overview) 

**Firewall Configuration**

Depending on your system/company firewall settings, you may need to allow inbound requests from Hands In in order to receive webhooks. Add the IP addresses for the environment you are using to your allowlist.

Outbound traffic leaves through one NAT gateway per availability zone, so **every address listed for your environment must be allowed** — a delivery can originate from any one of them, and which one is not predictable.

| Environment | IP Addresses                                    | Method |
| :---------- | :---------------------------------------------- | :----- |
| **Sandbox** | `13.134.254.170`, `16.60.72.94`, `13.42.175.21` | `POST` |
| **Live**    | `18.135.89.46`, `3.10.161.242`, `18.133.37.68`  | `POST` |

Webhooks are always delivered as an HTTPS `POST` with a JSON body. Each request carries a `x-handsin-signature` header (an HMAC-SHA256 of the raw body, signed with your endpoint's signing key) and a `HandsIn/1.0.0 (<api-base-url>)` user agent — for example `HandsIn/1.0.0 (https://api.sandbox.handsin.com)`. Your endpoint must respond with a `2xx` status within **4 seconds**, otherwise the delivery is treated as failed and retried with exponential backoff for up to 3 days.