Skip to main content
The IP allowlist compares the caller’s network address with the list. Behind a load balancer or an ingress, the address the service sees is the proxy’s, not the caller’s. This page tells a BYOC operator what to configure so the platform learns the real address.
This page applies to BYOC deployments only. On Lerian Cloud, Lerian operates this configuration for you. You only manage the list itself, in the Console or via API.
For the architecture view, read Tenant IP allowlist. For the enforcement contract, read the August 2026 announcement.

​
Trusted proxies

Set TRUSTED_PROXIES on every Lerian service you deploy, not only on the Access Manager:
  • The Access Manager Auth and Identity services.
  • Every product: Midaz, Flowker, Matcher, Reporter, Lender, Fetcher.
  • Every plugin and every Brazil rail you run, such as Fees or Pix.
Each product, plugin, or rail resolves the caller’s address on its own and forwards it to the Access Manager Auth service. A service without the variable forwards no address, and its requests are refused as soon as a workspace turns on the API access switch. On the Access Manager itself, the variable decides whether the allowlist enforces at all, as the table below shows. The value is a comma-separated list of CIDR ranges. List only the proxies that connect directly to that service.
Rules the platform applies to the value:
  • CIDR ranges only. A bare address without a prefix is rejected.
  • Very broad ranges are rejected: broader than /8 for IPv4 or /48 for IPv6. 0.0.0.0/0 never works.
  • On the Access Manager, a malformed value stops the service at startup.
What happens when the value is missing: Every service honors the API access switch only when its own deployment has TRUSTED_PROXIES set.

​
Validate the deployment

Run this check once after you set the variables, from a workspace whose list you control.
1

Activate a list with your own address

In the Console, add the address you connect from and tick Console access.
2

Sign in from a listed address

Sign in from that address. The sign-in must succeed.
3

Sign in from an unlisted address

Sign in from another network, such as a mobile connection. Expect a refusal.
4

Tick API access

Add the address your test client calls from and tick API access.
5

Call a Midaz endpoint from both addresses

Call any protected Midaz endpoint from the listed address, then from the unlisted one. Expect 200 and then 403 with code AUT-0021.
If the unlisted address is not refused, the platform is not learning the real address. Check TRUSTED_PROXIES on the service that answered.

Tenant IP allowlist architecture

How Auth, Identity, and each product share the check.

Manage the list in the Console

The administrator’s guide to the Security page.