IP whitelisting allows you to restrict an API key so that it only authenticates requests originating from specific IP addresses or networks.

How It Works #

• Each API key has an optional ip_whitelist field stored as a JSON array of IP addresses and/or CIDR ranges.
• When a request is made with a key that has a whitelist configured, the middleware checks the request’s originating IP against the whitelist after authentication.
• If the IP does not match any entry in the whitelist, the request is rejected with HTTP 403.
• If the whitelist is empty (not configured), requests from any IP address are accepted.

Supported Formats #

Configuring a Whitelist #

1. Navigate to DDLS > Developer > API Keys.
2. Click Edit on the key you want to restrict.
3. In the IP Whitelist field, enter one or more addresses or CIDR ranges separated by commas.
4. Click Save Changes.

IP Whitelist Rejection Response #

HTTP 403 Forbidden
{
  "code": "ip_not_whitelisted",
  "message": "Request IP address is not permitted for this API key."
}