Skip to main content
Each API key can now have its own list of allowed IPs. A key with a list works only from those addresses, so a leaked key can’t be used from anywhere else. This works for organization API keys and personal API keys.

​
What’s new

  • Allowed IPs on organization API keys, set when you create a key or later from Organization Settings > API Keys
  • Allowed IPs on personal API keys, set from Personal settings > Personal API Keys
  • An Allowed IPs column on both key lists, which shows Any IP for a key with no list
  • API endpoints to set a key’s list: Update an API Key IP allowlist and Update a personal API Key IP allowlist

​
How it works

  • A key’s list takes IPv4 and IPv6 addresses, subnets, and ranges, up to 50 entries.
  • Your organization’s IP allowlist still applies. A request must come from an address on both lists.
  • A key with no list of its own works from any address the organization allowlist accepts. Existing keys don’t change.
Learn more: Allowed IPs for one API key