Skip to main content

IP Allowlist

Restrict API access to specific IP ranges. Requests from outside the allowlist are rejected before reaching your handlers.

How It Works​

If the IP is not in the allowlist, the request returns 403 immediately — no handler code executes.

Viewing the Allowlist​

GET /v1/admin/org/{orgId}/ip-allowlist
Authorization: Bearer <management-key>

Response:

{
  "cidrs": ["203.0.113.0/24", "198.51.100.5/32"],
  "enabled": true
}

Updating​

PUT /v1/admin/org/{orgId}/ip-allowlist
Authorization: Bearer <management-key>

{
  "cidrs": ["203.0.113.0/24", "198.51.100.5/32", "10.0.0.0/8"],
  "enabled": true
}

Set enabled: false to disable the allowlist without losing the configured CIDRs.

When to Use​

  • Restrict management API access to your office VPN
  • Limit access check endpoints to your production VPC
  • Prevent API key usage from unexpected locations