A proper callback API should have a server-side shared secret field. You shouldn't have to rely on IP addresses for authentication.