> ## Documentation Index
> Fetch the complete documentation index at: https://docs.afriex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# IP allowlisting

> Restrict API access to your servers. One list covers every API key in your business.

An IP allowlist limits which addresses can call the API for your business. Afriex compares the address each request comes from with your list and rejects requests from any other address.

**The list belongs to your business, not to a key.** Every API key you create uses the same list, and you manage it in one place.

## When the allowlist applies

**An empty list means no restriction.** In sandbox and in production, the API accepts requests from any address until you add one. Once you add an address, the API accepts requests only from the addresses on your list, and rejects the rest.

We recommend adding your servers' addresses before you go live, so a leaked key can't be used from anywhere else. In production, requests must then come from a public address, and private ranges such as `10.0.0.5` are rejected.

<Warning>
  **The allowlist works over IPv4 only.** Once your list has an entry, a request that reaches Afriex over IPv6 is rejected, even from a server you allowlisted by its IPv4 address. `api.afriex.com` and `sandbox.api.afriex.com` both resolve to IPv6 addresses as well as IPv4, and a server with IPv6 usually prefers it. Make your API client connect over IPv4, for example `curl -4`, or `family: 4` in Node's `http`/`https` request options.
</Warning>

## What you can add

Each entry is an IPv4 address, such as `203.0.113.10`, or an IPv4 range in CIDR notation, such as `203.0.113.0/24`. You can add up to 100 entries. IPv6 addresses aren't supported yet.

## Add or remove addresses

<Steps>
  <Step title="Open the IP Whitelists tab">
    In the [Dashboard](https://business.afriex.com/), go to **Developer** and select the **IP Whitelists** tab.
  </Step>

  <Step title="Add addresses">
    Click **Set IP whitelist** if you have none yet, or **Add IP whitelist** to add more. Enter an address or range, click **Add**, repeat for each one, then click **Save**.
  </Step>

  <Step title="Remove an address">
    Click the **×** next to an entry and confirm.
  </Step>
</Steps>

<Tip>
  In test mode, **Allow all IPs** allowlists `0.0.0.0/0`, which matches every address. Use it if you want an allowlist in place while you call the sandbox from a laptop or a changing network. It isn't available in live mode.
</Tip>

## If a request is rejected

Once your list has an entry, a request can be rejected with `400` for three reasons. The message is in `details.friendlyMessage`:

| `code` | Message | Cause |
| - | - | - |
| `INVALID_BUSINESS_API_REQUEST` | `IP 203.0.113.99 is not allowed` | The address isn't on your list. The message names the address Afriex saw. |
| `INVALID_IP_ADDRESS` | `IPv6 not supported yet` | The request arrived over IPv6. Connect over IPv4. |
| `INVALID_IP_ADDRESS` | `IP address is not in public range` | In production, the request came from a private address. |

To fix it, add the address the request came from. That is the address of the server that sends the request, as the internet sees it, which can differ from the address inside your network.

* **Use a fixed outbound address.** If your servers sit behind a NAT gateway or a load balancer, allowlist its public address. Serverless platforms and autoscaled hosts often send from addresses that change, so route API calls through a static outbound address.
* **Check which address you sent from.** The error message shows the address Afriex saw. Add that address, or a range that contains it.

## Webhooks are separate

This allowlist controls requests **to** the Afriex API. It doesn't affect webhooks. To receive webhooks, allow the [Afriex webhook IP addresses](/api-reference/endpoint/webhooks/introduction#afriex-ip-addresses) on your own firewall.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.