> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cotizave.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Access control

> Restrict your API Key to your servers' IPs or to certain countries.

<span id="que-es" />

## What it is

Access control limits where your API Key can be used from. If someone obtains it, they cannot use it outside your networks. Set it up in the dashboard, under **Control de acceso**. Rules belong to the account: rotating the API Key does not change them.

It is included in the Escala plan. Other plans see the section but cannot create rules.

<span id="reglas" />

## IPs and countries

* **IPs and ranges:** IPv4, IPv6 or CIDR ranges (for example `203.0.113.0/24`), up to 3 per account. Each rule can be paused without deleting it.
* **Countries:** two-letter ISO codes (for example `VE`), up to 3 per account.

A request passes if its IP is in an active rule **or** it comes from an allowed country. With no active rules and no countries, the API Key works from anywhere.

Private and reserved IPs, and ranges that are too wide, are not accepted. A request whose country cannot be determined does not count as an allowed country.

The IP that counts is your server's, not your users'. If your server connects over IPv6, add its IPv6 address or range: an IPv4 rule does not cover it. **Suggestions** lists the IPs, IPv4 or IPv6, you have already called from.

<span id="rechazo" />

## Rejected request

A request from outside your list gets `403` with the code `ip_not_allowed`. The message names the IP we saw and, if you have allowed countries, the country:

```json theme={null}
{
  "code": "ip_not_allowed",
  "message": "This API key cannot be used from 203.0.113.7. Add it in Control de acceso or call from an allowed IP.",
  "field": "ip"
}
```

The rejection does not use requests or speed from your plan. Do not retry it: add the IP to your list or call from an allowed network.

<span id="panel" />

## In the dashboard

* **Suggestions:** the IPs your API Key was used from in recent days, to add them with one click.
* **Rejections:** requests blocked in the last 24 hours, by IP.
* **Confirmation:** if a change would lock out IPs that used your API Key in the last 24 hours, the dashboard asks you to confirm before applying it.
* **Notice:** if your API Key is used from an IP outside your list, we let you know in the dashboard, at most once a day.

Changes apply within seconds.

<span id="plan" />

## If you change plans

If you move to a plan without access control, your rules stay saved but stop applying: the API Key works from anywhere. You can delete them, or return to a plan that includes it and they apply again.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.