IP allowlist
Restrict which IPs may use the API. Even if someone obtained your API key, they could not use it outside your servers.
Configuration
- Configured in the panel → API Developer → APIs, per product and per environment (live and test are independent).
- Accepts single IPs and CIDR ranges, IPv4 and IPv6:
190.85.12.34,190.85.12.0/24,2800:e2:1a00::/40. Up to 100 entries per product. - Empty list = any IP. As soon as you add an entry, only those IPs can call the product's endpoints.
- A request from another IP gets
403 ip_not_allowed(after the key, product, endpoint and scope checks).
Which IP should I register?
The public egress IP of the servers calling the API (your integration server, the ERP server or your network's NAT/proxy), not the internal IP. If your ERP runs in the cloud (e.g. Siesa Cloud or Azure), ask your provider for its egress IP range. To check the IP you are calling from, open the request details in the panel's log after a test call.
If your egress IPs change (dynamic IP, autoscaling), register the full range or use
a fixed egress IP; otherwise your calls will start failing with 403 ip_not_allowed
without any change in your code.
Recommendation
Enable the list in live for every product you use. In test it can stay empty to make testing from developer machines easier.