Skip to main content
An IP allowlist limits which addresses can call the API for your business. Afriex compares the address each request comes from with your list and rejects requests from any other address. The list belongs to your business, not to a key. Every API key you create uses the same list, and you manage it in one place.

​
When the allowlist applies

An empty list means no restriction. In sandbox and in production, the API accepts requests from any address until you add one. Once you add an address, the API accepts requests only from the addresses on your list, and rejects the rest. We recommend adding your servers’ addresses before you go live, so a leaked key can’t be used from anywhere else. In production, requests must then come from a public address, and private ranges such as 10.0.0.5 are rejected.
The allowlist works over IPv4 only. Once your list has an entry, a request that reaches Afriex over IPv6 is rejected, even from a server you allowlisted by its IPv4 address. api.afriex.com and sandbox.api.afriex.com both resolve to IPv6 addresses as well as IPv4, and a server with IPv6 usually prefers it. Make your API client connect over IPv4, for example curl -4, or family: 4 in Node’s http/https request options.

​
What you can add

Each entry is an IPv4 address, such as 203.0.113.10, or an IPv4 range in CIDR notation, such as 203.0.113.0/24. You can add up to 100 entries. IPv6 addresses aren’t supported yet.

​
Add or remove addresses

1

Open the IP Whitelists tab

In the Dashboard, go to Developer and select the IP Whitelists tab.
2

Add addresses

Click Set IP whitelist if you have none yet, or Add IP whitelist to add more. Enter an address or range, click Add, repeat for each one, then click Save.
3

Remove an address

Click the × next to an entry and confirm.
In test mode, Allow all IPs allowlists 0.0.0.0/0, which matches every address. Use it if you want an allowlist in place while you call the sandbox from a laptop or a changing network. It isn’t available in live mode.

​
If a request is rejected

Once your list has an entry, a request can be rejected with 400 for three reasons. The message is in details.friendlyMessage: To fix it, add the address the request came from. That is the address of the server that sends the request, as the internet sees it, which can differ from the address inside your network.
  • Use a fixed outbound address. If your servers sit behind a NAT gateway or a load balancer, allowlist its public address. Serverless platforms and autoscaled hosts often send from addresses that change, so route API calls through a static outbound address.
  • Check which address you sent from. The error message shows the address Afriex saw. Add that address, or a range that contains it.

​
Webhooks are separate

This allowlist controls requests to the Afriex API. It doesn’t affect webhooks. To receive webhooks, allow the Afriex webhook IP addresses on your own firewall.