Skip to main content

​
What it is

Access control limits where your API Key can be used from. If someone obtains it, they cannot use it outside your networks. Set it up in the dashboard, under Control de acceso. Rules belong to the account: rotating the API Key does not change them. It is included in the Escala plan. Other plans see the section but cannot create rules.

​
IPs and countries

  • IPs and ranges: IPv4, IPv6 or CIDR ranges (for example 203.0.113.0/24), up to 3 per account. Each rule can be paused without deleting it.
  • Countries: two-letter ISO codes (for example VE), up to 3 per account.
A request passes if its IP is in an active rule or it comes from an allowed country. With no active rules and no countries, the API Key works from anywhere. Private and reserved IPs, and ranges that are too wide, are not accepted. A request whose country cannot be determined does not count as an allowed country. The IP that counts is your server’s, not your users’. If your server connects over IPv6, add its IPv6 address or range: an IPv4 rule does not cover it. Suggestions lists the IPs, IPv4 or IPv6, you have already called from.

​
Rejected request

A request from outside your list gets 403 with the code ip_not_allowed. The message names the IP we saw and, if you have allowed countries, the country:
The rejection does not use requests or speed from your plan. Do not retry it: add the IP to your list or call from an allowed network.

​
In the dashboard

  • Suggestions: the IPs your API Key was used from in recent days, to add them with one click.
  • Rejections: requests blocked in the last 24 hours, by IP.
  • Confirmation: if a change would lock out IPs that used your API Key in the last 24 hours, the dashboard asks you to confirm before applying it.
  • Notice: if your API Key is used from an IP outside your list, we let you know in the dashboard, at most once a day.
Changes apply within seconds.

​
If you change plans

If you move to a plan without access control, your rules stay saved but stop applying: the API Key works from anywhere. You can delete them, or return to a plan that includes it and they apply again.