> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Deployment requirements (BYOC)

> Configure the trusted proxies so the IP allowlist enforces in your own BYOC deployment.

The [IP allowlist](/en/platform/access-manager/features/ip-allowlist/overview) compares the caller's network address with the list. Behind a load balancer or an ingress, the address the service sees is the proxy's, not the caller's. This page tells a BYOC operator what to configure so the platform learns the real address.

<Note>
  This page applies to BYOC deployments only. On Lerian Cloud, Lerian operates this configuration for you. You only manage the list itself, in the Console or via API.
</Note>

For the architecture view, read [Tenant IP allowlist](/en/platform/access-manager/product-level-enforcement#tenant-ip-allowlist). For the enforcement contract, read the [August 2026 announcement](/en/news/2026/august/platform-ip-allowlist-enforcement-contract).

## Trusted proxies

***

Set `TRUSTED_PROXIES` on **every** Lerian service you deploy, not only on the Access Manager:

* The Access Manager **Auth** and **Identity** services.
* Every product: Midaz, Flowker, Matcher, Reporter, Lender, Fetcher.
* Every plugin and every Brazil rail you run, such as Fees or Pix.

Each product, plugin, or rail resolves the caller's address on its own and forwards it to the Access Manager Auth service. A service without the variable forwards no address, and its requests are refused as soon as a workspace turns on the **API access** switch. On the Access Manager itself, the variable decides whether the allowlist enforces at all, as the table below shows.

The value is a comma-separated list of CIDR ranges. List only the proxies that connect directly to that service.

<CodeGroup>
  ```text Example theme={null}
  TRUSTED_PROXIES=10.0.0.0/16,10.1.0.0/16
  ```
</CodeGroup>

Rules the platform applies to the value:

* CIDR ranges only. A bare address without a prefix is rejected.
* Very broad ranges are rejected: broader than `/8` for IPv4 or `/48` for IPv6. `0.0.0.0/0` never works.
* On the Access Manager, a malformed value stops the service at startup.

What happens when the value is missing:

| Where it is unset | Effect |
| - | - |
| Access Manager Auth | The allowlist does not enforce. A metric and a log line signal the untrusted-proxy condition. |
| Any other service, such as Midaz or a plugin | The service forwards no caller address. Its requests to a workspace with an active **API access** list are refused. |

Every service honors the **API access** switch only when its own deployment has `TRUSTED_PROXIES` set.

## Validate the deployment

***

Run this check once after you set the variables, from a workspace whose list you control.

<Steps>
  <Step title="Activate a list with your own address">
    In the Console, add the address you connect from and tick **Console access**.
  </Step>

  <Step title="Sign in from a listed address">
    Sign in from that address. The sign-in must succeed.
  </Step>

  <Step title="Sign in from an unlisted address">
    Sign in from another network, such as a mobile connection. Expect a refusal.
  </Step>

  <Step title="Tick API access">
    Add the address your test client calls from and tick **API access**.
  </Step>

  <Step title="Call a Midaz endpoint from both addresses">
    Call any protected Midaz endpoint from the listed address, then from the unlisted one. Expect `200` and then `403` with code `AUT-0021`.
  </Step>
</Steps>

If the unlisted address is not refused, the platform is not learning the real address. Check `TRUSTED_PROXIES` on the service that answered.

## Related pages

***

<Columns cols={2}>
  <Card title="Tenant IP allowlist architecture" icon="sitemap" href="/en/platform/access-manager/product-level-enforcement#tenant-ip-allowlist">
    How Auth, Identity, and each product share the check.
  </Card>

  <Card title="Manage the list in the Console" icon="desktop" href="/en/platform/access-manager/features/ip-allowlist/console">
    The administrator's guide to the Security page.
  </Card>
</Columns>