Skip to main content
The IP allowlist compares the caller’s network address with the list. Behind a load balancer or an ingress, the address the service sees is the proxy’s, not the caller’s. This page tells a BYOC operator what to configure so the platform learns the real address.
This page applies to BYOC deployments only. On Lerian Cloud, Lerian operates this configuration for you. You only manage the list itself, in the Console or via API.
For the architecture view, read Tenant IP allowlist. For the enforcement contract, read the August 2026 announcement.

​
Trusted proxies

Set TRUSTED_PROXIES on every service that takes part in the check:
  • The Access Manager Auth and Identity services.
  • Every product that authorizes requests: Midaz, Flowker, and the others you deploy.
The value is a comma-separated list of CIDR ranges. List only the proxies that connect directly to that service.
Rules the platform applies to the value:
  • CIDR ranges only. A bare address without a prefix is rejected.
  • Very broad ranges are rejected: broader than /8 for IPv4 or /48 for IPv6. 0.0.0.0/0 never works.
  • On the Access Manager, a malformed value stops the service at startup.
What happens when the value is missing: Midaz honors the API access switch when its deployment has TRUSTED_PROXIES set.

​
Console flags

Set two variables on the Console so the feature appears to your administrators: Without the first flag, administrators cannot reach the list from the Console. Without the second, they can restrict Console access but not API access.

​
Validate the deployment

Run this check once after you set the variables, from a workspace whose list you control.
1

Activate a list with your own address

In the Console, add the address you connect from and tick Console access.
2

Sign in from a listed address

Sign in from that address. The sign-in must succeed.
3

Sign in from an unlisted address

Sign in from another network, such as a mobile connection. Expect a refusal.
4

Tick API access

Add the address your test client calls from and tick API access.
5

Call a Midaz endpoint from both addresses

Call any protected Midaz endpoint from the listed address, then from the unlisted one. Expect 200 and then 403 with code AUT-0021.
If the unlisted address is not refused, the platform is not learning the real address. Check TRUSTED_PROXIES on the service that answered.

Tenant IP allowlist architecture

How Auth, Identity, and each product share the check.

Manage the list in the Console

The administrator’s guide to the Security page.