Skip to main content
This guide shows how to manage the IP allowlist from the Console. You add addresses, choose where the list applies, and deactivate it when you no longer need it.

​
Before you start

You need the security permission with the get action to open the page and the put action to change the list. Lerian’s default administrator role has both. Without get, the page shows “You are not authorized to access this page.” Know the address you connect from. The Console shows it to you in several dialogs and in the Add my IP button. If you connect through a VPN or a corporate proxy, the address you see is the address of that VPN or proxy.

​
Open the IP allowlist tab

1

Open Settings

Click the gear icon () in the top navigation bar.
2

Select Security

Select Security in the Settings sidebar. The page title is “Security”.
3

Select the IP allowlist tab

The page opens on the Single Sign-On tab. Select the IP allowlist tab. You can also open the path /settings/security?tab=ip-allowlist directly.
The Security page in the Console, open on the IP allowlist tab. The amber banner reads "IP allowlist inactive" and the empty-state box reads "No IP addresses registered. While the list is empty, access is not restricted." The "Add my IP" and "Add IP" buttons sit above the box.

Figure 1. The IP allowlist tab with an empty list

​
Read the page

The tab subtitle reads “Restrict platform access to a list of trusted IP addresses.” A status banner tells you whether the platform enforces the list now: Three buttons sit above the list:
  • Add my IP adds the address you connect from. When the Console cannot determine it, it disables the button and shows the tooltip “Your IP address could not be determined.”
  • Add IP opens a side sheet where you type an address or a range.
  • Deactivate appears only when the list has at least one entry.

​
Add an address

1

Open the side sheet

Click Add IP. The side sheet “Add IP address” opens with the description “Add an IP address or CIDR range to the allowlist.”
2

Type the address or range

Fill in IP address or CIDR range. The placeholder shows the accepted forms, such as 203.0.113.5 or 203.0.113.0/24.Optionally, fill in Description with a label of up to 255 characters, for example “São Paulo office”. The description is only a label and does not change access.To add your own address instead, click Add my IP inside the sheet. When the Console knows your address, the button shows it in parentheses. The entry keeps the description you typed.
3

Save

Click Save. The Console validates the entry before it saves it.
The Console rejects two kinds of input:
  • A value that is not an address or a CIDR range shows “Enter a valid IP address or CIDR range”.
  • A value already on the list shows “This entry is already in the list.” 203.0.113.5 and 203.0.113.5/32 count as the same entry.

​
When you add the first entry

When you add the first entry, the Console asks you to confirm with the dialog “Activate the IP allowlist?”. The text reads:
Once activated, only requests from your listed IP addresses are accepted on the surfaces ticked under “Where this list is applied”. Your current IP is {ip}.
Click Activate to continue or I changed my mind to go back.

​
When your own address is not on the list

The list can apply to Console access and not cover the address you connect from. If your address is not a private network address, the Console adds it to the list before it saves. It then shows the notice “We also added your current IP ({entry})”. The notice explains why and how to delete the entry later. If the list has no room for your address, the Console opens the dialog “We could not add your current IP to this list” instead.

​
When your address is a private network address

You can connect from a private network address that a list for Console access does not cover. In that case, the Console asks you first. The dialog “We see your access coming from {ip}, a private network address” explains that the address may belong to your VPN or a proxy. Click Include it anyway to add it, or Continue without including it to leave it out.

​
Choose where the list applies

The section “Where this list is applied:” appears below the table once the list has at least one entry. It holds two checkboxes:
  • Console access: “only the addresses above can sign in and use the console”.
  • API access: “only the addresses above can use the API with your credentials”.
The Console saves each change as soon as you tick or untick a checkbox.

​
Apply the list to API access

When you tick API access, the Console asks you to confirm. The dialog “Your integrations have to be on the list above” opens. It names the systems that call the API with your credentials: webhooks, ERPs, scheduled jobs, application tokens. It asks you to review the list before you confirm. Click Apply to API access to confirm.
Do not tick API access until every integration’s outgoing address is on the list.

​
Untick both checkboxes

If you untick both checkboxes, the list stays saved but does nothing. The banner turns amber. The note below the checkboxes reads “The list is saved but enforced nowhere — access is not restricted.”

​
Delete an entry

1

Find the entry

Find the row in the table. The “IP address / CIDR” column shows the entry, and the “Description” column shows its label. The footer reads “Showing N IP entries.”
2

Click the trash icon

Click the trash icon (“Delete”) on the row. The dialog “Remove this entry?” opens.
3

Confirm

Read the text “Once removed, requests from this IP range will no longer be allowed.” Click Yes, remove it.
The deletion can leave your own address outside a list for Console access. In that case, the Console then opens the dialog “Your IP is not in this list”. It warns that you may lose access to this workspace if you save. Click Save anyway only if you control another address on the list. Deleting the last entry deactivates the list, so the Console shows the deactivation dialog instead.

​
Deactivate the list

Deactivation clears every entry.
1

Click Deactivate

Click Deactivate above the table.
2

Confirm

The dialog “Deactivate the IP allowlist?” reads “This clears every entry and allows access from any IP address again.” Click Yes, deactivate.
The dialog "Deactivate the IP allowlist?" over the Security page. The body reads "This clears every entry and allows access from any IP address again." The buttons read "I changed my mind" and "Yes, deactivate".

Figure 2. The deactivation dialog

To pause the list without losing the entries, untick both checkboxes instead. The entries stay saved and you can apply them again later.

​
Messages the Console shows

After a successful change, the Console shows “IP allowlist updated”. When the platform refuses a change, the Console shows the refusal in a notification. The API errors list the causes.

IP allowlist

What the feature protects, how it decides, and what it does not cover.

Manage the list via API

Read and replace the list with two Identity API operations.