IP allowlist
Live apps accept requests only from the addresses you list; sandbox apps only when you add some.
Each app has an IP allowlist: public IPv4 or IPv6 addresses and ranges (CIDR), e.g. 185.10.20.10 or 2a00:1450:4001::/48.
Live and sandbox#
| App | Empty list | With entries |
|---|---|---|
| Live | every request is refused with 403 ip_allowlist_empty |
only listed addresses; others get 403 ip_not_allowed |
| Sandbox | not enforced | only listed addresses; others get 403 ip_not_allowed |
A live app needs at least one entry before its first request. Give your servers' egress addresses in the note when you request live access; we put them on the live app, and you confirm them.
Which address we check#
We use the address that connected to us, as our hosting platform reports it. Behind our CDN, we use the client address the CDN reports — but only when the connection really came from the CDN. X-Forwarded-For is ignored: setting it changes nothing. If we cannot determine your address, the request is refused with ip_not_allowed.
Editing the list#
In the Partner Portal, Integration › Apps and keys, open the app and edit IP allowlist: Add address, remove a row, Save. Admins edit; developers read. The change applies to the next request.
- Each entry must be a public network no broader than /16 (IPv4) or /48 (IPv6); a single address is stored as
/32or/128. Anything else is refused withcidr_invalid:- not an address or range: "Enter a public IPv4 or IPv6 address or range (e.g. 185.10.20.10 or 2a00:1450:4001::/48)."
- broader than /16 or /48, including
/0: "A range can be at most /16 (IPv4) or /48 (IPv6); /0 is not allowed." - a private, reserved or documentation range: "Private and reserved ranges are not allowed. Enter the public address your servers call from."
- The allowlist names your servers' egress, never the whole internet: a live app cannot be opened to every address.
- On a live app, an empty list shows "Live requests are refused until you add at least one address."
Last updated