> ## Documentation Index
> Fetch the complete documentation index at: https://docs.envzero.com/llms.txt
> Use this file to discover all available pages before exploring further.

# IP Allowlisting for Logins, API Keys, and the Agent API

> Restrict access to your organization to a set of approved source IP addresses, covering UI logins, API keys, and the Agent API.

env zero now supports an organization-level IP allowlist that restricts logins and unattended access to a set of approved source IP addresses or ranges. This closes a gap where a compromised API key or service token could be used from any location.

## What's new

* **IP allowlisting for UI logins**, including multi-org SSO
* **IP allowlisting for API keys and service tokens**, so a compromised key can't be used to reach env zero from an untrusted network
* **IP allowlisting for the Agent API**, adding defense in depth on top of token-based authentication for self-hosted and SaaS agents

## How it works

* The allowlist is configured per organization, supporting both IPv4 and IPv6 addresses and subnets.
* If no allowlist is configured, all IPs are allowed. There's no change in behavior for organizations that don't opt in.
* Once configured, logins and API/Agent requests are only permitted from an approved IP or subnet. Allowlist updates take effect immediately.

<Info>
  IP allowlisting is configured at the organization level. Contact your env zero account team or [support](mailto:support@env0.com) to enable and configure it for your organization.
</Info>

Learn more: [Security Overview](/guides/overview/security-overview)