Skip to main content
The firewall uses one shared whitelist for your broker, with an IP Whitelist setting on each key. It applies to both Live and Sandbox keys.
  • Enabled: The caller’s address must match an entry in the shared list.
  • Disabled: The key can authenticate from any source address.
Only an Admin can change firewall settings. Use the integration’s public outbound address, not its local or inbound address.

​
Add allowed addresses

  1. Open API Center > API Firewall > Configure Settings.
  2. Enter an address in IP Address.
  3. Add a Note (Optional) to identify the system, then select Add IP.
Use an exact IPv4 or IPv6 address, or a bounded CIDR range. Broad all-network /0 ranges are not allowed. Entries must be unique. Add every possible outbound address for a NAT gateway, proxy, or egress service, and do not put secrets in notes.

​
Restrict a key

For an existing key, add at least one whitelist entry, then open the key’s Actions menu and select Enable IP Whitelist. Confirm the column shows Enabled. For a new key, select Restrict by IP address during key creation. You can create it with an empty whitelist, but it rejects all requests until an allowed address is added. To remove a key’s restriction, select Disable IP Whitelist. This does not delete the shared entries.
Every whitelist change affects all restricted keys for your broker. Adding an address can allow it to use any of those keys. Removing the last entry blocks all requests using restricted keys; it does not disable their restrictions.

​
Remove an address

Open API Firewall Configuration, select the entries in Whitelist Management, and select Remove Selected. Check which integrations rely on those entries first.

​
Troubleshoot a blocked request

A valid but blocked key receives HTTP 403 with code insufficient_permissions and message IP address not whitelisted. This rejection does not update Last Used. Invalid keys receive 401 before the firewall check.
  1. Confirm the expected key is active and has the intended IP restriction.
  2. Check the integration’s current outbound IP and its matching address or CIDR entry.
  3. Run Verify API Access from the same system and network path.
A 403 can also mean a missing scope. See Errors and Retries for troubleshooting and what to send support safely.
Last modified on September 8, 2026