IP verification

[Guennadi Moukine]

At which point does OpenSRS verifies that the call comes from an authorized IP?
Is it at the beginning of the session when checking domain dame 
availability or when choosing a password or during the last "register" action?
I need to know because one of my pages is executed by my payment gateway 
provider (HTTP call). I need to know if I need to specify their IP as well 
in the list of authorized IPs.
Does it make sense?

Thanks,
Guennadi M