These flags apply to BYOC deployments only. On Lerian Cloud, Lerian manages them for you. The Security section appears only when your operator enabled it with
NEXT_PUBLIC_SECURITY_TAB_ENABLED=true. The API access checkbox appears only with NEXT_PUBLIC_SECURITY_API_SCOPE_ENABLED=true. See Deployment requirements.Before you start
You need the
security permission with the get action to open the page and the put action to change the list. Lerian’s default administrator role has both. Without get, the page shows “You are not authorized to access this page.”
Know the address you connect from. The Console shows it to you in several dialogs and in the Add my IP button. If you connect through a VPN or a corporate proxy, the address you see is the address of that VPN or proxy.
Open the IP allowlist tab
1
Open Settings
Click the gear icon () in the top navigation bar.
2
Select Security
Select Security in the Settings sidebar. The page title is “Security”. The subtitle reads “Control how people sign in and where the platform can be reached from.”
3
Select the IP allowlist tab
The page opens on the Single Sign-On tab. Select the IP allowlist tab. You can also open the path
/settings/security?tab=ip-allowlist directly.
Figure 1. The IP allowlist tab with an empty list
Read the page
The tab subtitle reads “Restrict platform access to a list of trusted IP addresses.” A collapsible section, “What is the IP allowlist?”, explains the feature in a few lines. A status banner tells you whether the list is enforced right now:
Three buttons sit above the list:
- Add my IP adds the address you are connected from. When the Console cannot determine it, the button is disabled with the tooltip “Your IP address could not be determined.”
- Add IP opens a side sheet where you type an address or a range.
- Deactivate appears only when the list has at least one entry.
Add an address
1
Open the side sheet
Click Add IP. The side sheet “Add IP address” opens with the description “Add an IP address or CIDR range to the allowlist.”
2
Type the address or range
Fill in IP address or CIDR range. The placeholder shows the accepted forms:
e.g. 203.0.113.5 or 203.0.113.0/24.To add your own address instead, click Add my IP (your address) inside the sheet.3
Save
Click Save. The Console validates the entry before it saves it.
Figure 2. The Add IP address side sheet
- A value that is not an address or a CIDR range shows “Enter a valid IP address or CIDR range”.
- A value already on the list shows “This entry is already in the list.”
203.0.113.5and203.0.113.5/32count as the same entry.
When you add the first entry
After you save the first entry, the list is enforced only when at least one checkbox under “Where this list is applied” is ticked. The Console asks you to confirm with the dialog “Activate the IP allowlist?”. The text reads:
Once activated, only requests from your listed IP addresses are accepted on the surfaces ticked under “Where this list is applied”. Your current IP is {ip}.
Click Activate to continue or I changed my mind to go back.
Figure 3. The activation dialog
When your own address is not on the list
If the address you connect from is not covered by the list you are about to save, the Console warns you. The dialog “Your IP is not in this list” reads:
Your current IP {ip} is not covered by this list. If you save, you may lose access to this workspace.
Click Save anyway only if you are sure another listed address is under your control.
When the Console adds your address for you, it shows the notice “We also added your current IP ({entry})”. The notice explains why and how to delete the entry later.
When your address is a private network address
If the Console sees you connect from a private network address, it tells you. The dialog “We see your access coming from{ip}, a private network address” explains that the address may belong to your VPN or a proxy.
Click Include it anyway to add it, or Continue without including it to leave it out.
Choose where the list applies
The section “Where this list is applied:” appears below the table once the list has at least one entry. It holds two checkboxes:
- Console access — “only the addresses above can sign in and use the console”.
- API access — “only the addresses above can use the API with your credentials”.
Figure 4. A saved list before you choose where it applies
Apply the list to API access
The first time you tick API access, the Console asks you to confirm. The dialog “Your integrations have to be on the list above” reads:Once this is on, any system calling the API with your credentials from an address that is not listed stops working immediately: webhooks, ERPs, scheduled jobs, application tokens. Those addresses are usually not the same ones you use to reach the console. Review the list before confirming.Click Apply to API access to confirm.
Figure 5. The API access confirmation
Untick both checkboxes
If you untick both checkboxes, the list stays saved but is enforced nowhere. The banner turns amber and reads “The list is saved but enforced nowhere — access is not restricted.” Access is unrestricted until you tick a checkbox again.Delete an entry
1
Find the entry
Find the row in the table. The column is “IP address / CIDR”. The footer reads “Showing N IP entries.”
2
Click the trash icon
Click the trash icon (“Delete”) on the row. The dialog “Remove this entry?” opens.
3
Confirm
Read the text “Once removed, requests from this IP range will no longer be allowed.” Click Yes, remove it.
Deactivate the list
Deactivation clears every entry and allows access from any address again.
1
Click Deactivate
Click Deactivate above the table.
2
Confirm
The dialog “Deactivate the IP allowlist?” reads “This clears every entry and allows access from any IP address again.” Click Yes, deactivate.
Figure 6. The deactivation dialog
Messages the Console shows
Related pages
IP allowlist
What the feature protects, how it decides, and what it does not cover.
Manage the list via API
The same changes through two Identity API operations.