All Collections
Ensure origin server access: how to whitelist TwicPics requests
Ensure origin server access: how to whitelist TwicPics requests

Whitelisting TwicPics: Address 403/504 errors, server protection compatibility, and IP filtering.

Benjamin Arne avatar
Written by Benjamin Arne
Updated over a week ago

Determine the need to whitelist TwicPics

Whether you're troubleshooting specific issues or seeking to ensure smooth integration of TwicPics, you may encounter or anticipate the scenarios below:

  • 403 Forbidden Errors: The server recognizes but refuses TwicPics' requests.

  • Cloudfront 504 Errors - "source: timeout (response was not received in 10,000 ms)": Timeout issue between TwicPics and your server, possibly due to whitelisting issues.

  • Using server protection: Systems like Anti-DOS, WAF, Rate limiting, IP Filtering or Bot Management Solutions Systems can inadvertently block TwicPics requests.

Experiencing these? Whitelisting TwicPics should be your next step.

Whitelist TwicPics requests using x-twicpics-token header

The primary way to resolve these conflicts is to whitelist TwicPics by using the x-twicpics-token header. By default TwicPics add the x-twicpics-token header to every request made to your origin.
This token's value is specific to your domain and can be found on the backend:

Whitelist the token: Ensure that your server or security layer accepts requests that come with the x-twicpics-token header. The general rule is: "if a request has this header with its unique value, it should be allowed access."

Fallback option: set an authentication mode supported by TwicPics

If for some reason you cannot whitelist using the token, TwicPics offers alternative authentication methods for private servers:

You can setup one during path creation or edition.

What about IP Filtering?

TwicPics doesn't use fixed IPs due to the decentralised nature of our service. If your server uses IP filtering as a security measure we highly recommend to add, or to replace it by, header authentication with the x-twicpics-token header provided.

As a last resort, if you need to continue using IP-based security, you can find Cloudfront IP masks used by TwicPics at this address: for temporary whitelisting, especially during development or troubleshooting phases.


TwicPics aims to provide seamless image optimization. Ensuring our service is whitelisted will help maintain uninterrupted service and optimal image delivery. If any conflicts arise, always refer back to these solutions or reach out to our support team for further assistance.

Did this answer your question?