> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Deployment requirements (BYOC)

> Configure the trusted proxies and the Console flags so the IP allowlist enforces in your own BYOC deployment.

The [IP allowlist](/en/platform/access-manager/features/ip-allowlist/overview) compares the caller's network address with the list. Behind a load balancer or an ingress, the address the service sees is the proxy's, not the caller's. This page tells a BYOC operator what to configure so the platform learns the real address.

<Note>
  This page applies to BYOC deployments only. On Lerian Cloud, Lerian operates this configuration for you. You only manage the list itself, in the Console or via API.
</Note>

For the architecture view, read [Tenant IP allowlist](/en/platform/access-manager/product-level-enforcement#tenant-ip-allowlist). For the enforcement contract, read the [August 2026 announcement](/en/news/2026/august/platform-ip-allowlist-enforcement-contract).

## Trusted proxies

***

Set `TRUSTED_PROXIES` on every service that takes part in the check:

* The Access Manager **Auth** and **Identity** services.
* Every product that authorizes requests: Midaz, Flowker, and the others you deploy.

The value is a comma-separated list of CIDR ranges. List only the proxies that connect directly to that service.

<CodeGroup>
  ```text Example theme={null}
  TRUSTED_PROXIES=10.0.0.0/16,10.1.0.0/16
  ```
</CodeGroup>

Rules the platform applies to the value:

* CIDR ranges only. A bare address without a prefix is rejected.
* Very broad ranges are rejected: broader than `/8` for IPv4 or `/48` for IPv6. `0.0.0.0/0` never works.
* On the Access Manager, a malformed value stops the service at startup.

What happens when the value is missing:

| Where it is unset       | Effect                                                                                                          |
| ----------------------- | --------------------------------------------------------------------------------------------------------------- |
| Access Manager Auth     | The allowlist does not enforce. A metric and a log line signal the untrusted-proxy condition.                   |
| A product such as Midaz | The product forwards no caller address. Requests to a workspace with an active **API access** list are refused. |

Midaz honors the **API access** switch when its deployment has `TRUSTED_PROXIES` set.

## Console flags

***

Set two variables on the Console so the feature appears to your administrators:

| Variable                                      | Effect                                                             |
| --------------------------------------------- | ------------------------------------------------------------------ |
| `NEXT_PUBLIC_SECURITY_TAB_ENABLED=true`       | Shows the Security section in Settings, with the IP allowlist tab. |
| `NEXT_PUBLIC_SECURITY_API_SCOPE_ENABLED=true` | Shows the **API access** checkbox on the IP allowlist tab.         |

Without the first flag, administrators cannot reach the list from the Console. Without the second, they can restrict Console access but not API access.

## Validate the deployment

***

Run this check once after you set the variables, from a workspace whose list you control.

<Steps>
  <Step title="Activate a list with your own address">
    In the Console, add the address you connect from and tick **Console access**.
  </Step>

  <Step title="Sign in from a listed address">
    Sign in from that address. The sign-in must succeed.
  </Step>

  <Step title="Sign in from an unlisted address">
    Sign in from another network, such as a mobile connection. Expect a refusal.
  </Step>

  <Step title="Tick API access">
    Add the address your test client calls from and tick **API access**.
  </Step>

  <Step title="Call a Midaz endpoint from both addresses">
    Call any protected Midaz endpoint from the listed address, then from the unlisted one. Expect `200` and then `403` with code `AUT-0021`.
  </Step>
</Steps>

If the unlisted address is not refused, the platform is not learning the real address. Check `TRUSTED_PROXIES` on the service that answered.

## Related pages

***

<Columns cols={2}>
  <Card title="Tenant IP allowlist architecture" icon="sitemap" href="/en/platform/access-manager/product-level-enforcement#tenant-ip-allowlist">
    How Auth, Identity, and each product share the check.
  </Card>

  <Card title="Manage the list in the Console" icon="desktop" href="/en/platform/access-manager/features/ip-allowlist/console">
    The administrator's guide to the Security page.
  </Card>
</Columns>