Tabby will renew the public SSL certificates for 'tabby.ai' and 'tabby.sa' on 15 April 2026 at 09:00 UTC.
No action is required for most partners. This change only affects partners whose production integrations use SSL certificate pinning. If your integration does not pin Tabby certificates, no changes are needed.
For affected partners, the renewed certificate chain must be added before the rotation time to avoid connectivity issues.
Completed -
Webhook IP address changes were applied on 23 March 2026. Redirect link changes are currently being rolled out and are expected to be fully completed within the next two weeks under close monitoring. API domain changes for the mentioned API endpoints are also scheduled to be applied within the next two weeks.
Mar 30, 14:38 UTC
Update -
We will be undergoing scheduled maintenance during this time.
Mar 11, 11:47 UTC
Scheduled -
Tabby is introducing an update to how transactions in Saudi Arabia are processed.
If your integration processes Tabby payments in KSA, you may need to update certain technical configurations before 23 March 2026 to ensure payments continue processing normally. No downtime is planned for this change. Businesses operating only in the UAE or Kuwait are not affected.
Action required Verify whether your systems enforce IP allowlisting, redirect URL domain validation, or fixed API base URLs, and update them if necessary to ensure your integration continues processing Tabby payments in Saudi Arabia (KSA) after 23 March 2026.
If required updates are not implemented by this date, some integrations may experience: - Failed webhook delivery - Customers unable to open checkout pages - Missing KSA data for certain API endpoints
Please check whether your systems enforce any of the following: - Webhook IP allowlisting - Redirect URL domain validation - Fixed API base URLs
1. Webhook IP allowlisting If your system restricts incoming webhooks by IP address, add the following IPs used for KSA payment and dispute webhooks: 34.166.128.182, 34.166.170.3, 34.166.249.7.
2. Redirect domain validation If your backend or mobile applications validate redirect domains, ensure the following domains are accepted: https://checkout.tabby.sa https://api.tabby.sa After the change, KSA checkout links will be issued under these domains.
3. API routing (if applicable) Some endpoints serving Saudi Arabia traffic will be available under: https://api.tabby.sa