Skip to main content
This guide shows how to manage the IP allowlist from the Console. You add addresses, choose where the list applies, and deactivate it when you no longer need it.

Before you start

You need the security permission with the get action to see the IP allowlist tab and the put action to change the list. Lerian’s default administrator role has both. Without get, the Security page does not show the IP allowlist tab. Know the address you connect from. The Console shows it to you in several dialogs and in the Add my IP button. If you connect through a VPN or a corporate proxy, the address you see is the address of that VPN or proxy.

Open the IP allowlist tab

1

Open Settings

Click the gear icon () in the top navigation bar.
2

Select Security

Select Security in the Settings sidebar. The page title is “Security”.
3

Select the IP allowlist tab

The page opens on the Single Sign-On tab. Select the IP allowlist tab. You can also open the path /settings/security?tab=ip-allowlist directly.

Read the page

The tab subtitle reads “Restrict platform access to a list of trusted IP addresses.” A status banner tells you whether the platform enforces the list now: When your deployment has no trusted proxies configured, the Console shows “This list cannot be enforced”. Read Deployment requirements. Two buttons sit above the list and one sits below the switches:
  • Add my IP adds the address you connect from. When the Console cannot determine it, it disables the button and shows the tooltip “Your IP address could not be determined.”
  • Add IP entry opens a side sheet where you type an address or a range.
  • Deactivate appears only when the list has at least one entry.

Add an address

1

Open the side sheet

Click Add IP entry. The side sheet “Add IP entry” opens with the description “Add an IP address or CIDR range to the allowlist.”
2

Type the address or range

Fill in IP address or CIDR range. The placeholder shows the accepted forms, such as 203.0.113.5 or 203.0.113.0/24.Optionally, fill in Description with a label of up to 255 characters, for example “São Paulo office”. The description is only a label and does not change access.To add your own address instead, click Add my IP inside the sheet. When the Console knows your address, the button shows it in parentheses. The entry keeps the description you typed.
3

Save

Click Save. The Console validates the entry before it saves it.
The Console rejects two kinds of input:
  • A value that is not an address or a CIDR range shows “Enter a valid IP address or CIDR range”.
  • A value already on the list shows “This entry is already in the list.” 203.0.113.5 and 203.0.113.5/32 count as the same entry.

When you add the first entry

When you add the first entry, the Console asks you to confirm with the dialog “Activate the IP allowlist?”. The text reads:
Once activated, only requests from your listed IP addresses are accepted on the surfaces turned on under “Where this list is applied”. Your current IP is {ip}.
Click Activate to continue or Cancel to go back.

When your own address is not on the list

The list can apply to Console access and not cover the address you connect from. If your address is not a private network address, the Console adds it to the list before it saves. It then shows the notice “We also added your current IP ({entry})”. The notice explains why and how to delete the entry later. If the list has no room for your address, the Console opens the dialog “We could not add your current IP to this list” instead.

When your address is a private network address

You can connect from a private network address that a list for Console access does not cover. In that case, the Console asks you first. The dialog “We see your access coming from {ip}, a private network address” explains that the address may belong to your VPN or a proxy. Click Include it and save to add it, or Save without it to leave it out.

Choose where the list applies

The section “Where this list is applied” appears below the table. It holds two switches:
  • Console access: “only the addresses above can sign in and use the console”.
  • API access: “only the addresses above can use the API with your credentials”.
The Console saves each change as soon as you turn a switch on or off.

Apply the list to API access

When you turn on API access, the Console asks you to confirm. The dialog “Your integrations have to be on the list above” opens. It names the systems that call the API with your credentials: webhooks, ERPs, scheduled jobs, application tokens. It asks you to review the list before you confirm. Click Apply to API access to confirm.
Do not turn on API access until every integration’s outgoing address is on the list.

Turn off both switches

If you turn off both switches, the list stays saved but does nothing.

Change the label of an entry

Open the row’s actions menu and select Edit. The side sheet “Edit {entry}” changes the description only. The address stays as it is.

Delete an entry

1

Find the entry

Find the row in the table. The “IP address / CIDR” column shows the entry, and the “Description” column shows its label. The footer reads “Showing N IP entries.”
2

Open the actions menu

Open the row’s actions menu and select Delete. The dialog “Delete IP entry?” opens.
3

Confirm

Read the text “You are about to delete {entry}. Requests from this IP range will no longer be allowed.” Click Delete.
The deletion can leave your own address outside a list for Console access. In that case, the Console then opens the dialog “Your IP is not in this list”. It warns that you may lose access to this workspace if you save. Click Save anyway only if you control another address on the list. Deleting the last entry deactivates the list, so the Console shows the deactivation dialog instead.

Deactivate the list

Deactivation clears every entry.
1

Click Deactivate

Click Deactivate below the switches.
2

Confirm

The dialog “Deactivate the IP allowlist?” reads “This clears every entry and allows access from any IP address again.” Click Deactivate.
To pause the list without losing the entries, turn off both switches instead. The entries stay saved and you can apply them again later.

Messages the Console shows

After a successful change, the Console shows “IP allowlist updated”. When the platform refuses a change, the Console shows the refusal in a notification. The API errors list the causes.

IP allowlist

What the feature protects, how it decides, and what it does not cover.

Manage the list via API

Read and replace the list with two Identity API operations.