We are trying to build automation to restrict our backend gateway to Cloudflare public infrastructure IP addresses only. We are wondering how often does the public IP addresses changes, and what the time window allow us to update the configuration on our end in case IP addresses are being added or removed from cloudlfare?
I don’t believe there’s any official timelines that are followed, but looking at the IPs page:
There have been a total of 3 updates in many many years. So I’d say that as long as you’re hitting these endpoints every so often (also available in the API), you should be fine.
Another option if you don’t want to worry about this would be to use Cloudflare Tunnels.
The things we are trying to build automation around the API, in case of adding an IP address we might run into issues with some of the requests through the new IP will get rejected if our infra configuration is not updated promptly