Skip to main content
The IP allowlist is a list of network addresses that your workspace trusts. The list belongs to the whole workspace, not to one person or one application.

​
What the allowlist protects

The allowlist has two switches. You can turn on one, the other, or both.
Do not turn on API access before you list every address your integrations call from. Those addresses are usually not the same ones your team uses to reach the Console.

​
How the platform decides

A request to a protected route goes through this check, in this order:
  1. A request arrives at the platform with your workspace’s credentials.
  2. The platform works out the network address the request came from. Behind your load balancer, it reads the address your proxy forwards. On BYOC, see Deployment requirements. On Lerian Cloud, Lerian handles this for you.
  3. The platform checks whether the list is active for that kind of access, Console or API, and whether the address is on the list.

​
What a refused person or system sees

See the Access Manager error list.

​
What you can register

An entry is a single address or a range of addresses, in IPv4 or IPv6. Rules that apply to the list:
  • Use CIDR notation for ranges. The platform does not accept “from-to” ranges such as 203.0.113.1-203.0.113.50.
  • The platform merges duplicates. 203.0.113.5 and 203.0.113.5/32 are the same entry.
  • The platform rejects a range broader than /24 for IPv4 or /48 for IPv6.
  • The stored entries, separated by commas, must fit in 200 characters. Prefer ranges over long lists of single addresses.
  • An entry can have a description, such as the name of the office. The description is text for your administrators. It does not change the access decision.

​
The three states of the list

The Console shows the current state in a banner at the top of the IP allowlist tab.

​
Safety behaviors in the Console

The Console helps you avoid locking yourself out.
  • Before the first entry activates the list, the Console asks you to confirm.
  • If the list applies to Console access and does not cover your own address, the Console adds your address or asks you before it saves.
  • An Add my IP button adds the address you connect from.
  • The Console asks for a separate confirmation before it applies the list to API access.
Read the step-by-step guide in Manage the IP allowlist in the Console.

​
What the allowlist does not cover

  • Lerian’s own platform services keep working. Requests that carry a platform-internal token bypass the list, so your workspace does not stop by accident.
  • There is no administrator exemption. Keep at least one address you control on the list.
  • Break-glass. If every administrator is locked out, contact Lerian support to restore access.

​
Next steps

Manage the list in the Console

Add addresses, choose where the list applies, and deactivate it.

Manage the list via API

Read and replace the list with two Identity API operations, with examples.

Deployment requirements

What a BYOC operator configures so the platform learns the caller’s real address.

Error list

Every code the allowlist can return, with title and message.