Skip to main content
A network access policy restricts which source IPs can use an individual API key. Once configured, only IPs in the allowed list can use the key to invoke models; requests from other sources are rejected. A network access policy is configured per key, and policies are independent. An empty allowed list does not restrict the source IP.
Network access applies only to model invocation. Management endpoints, including billing queries and key policy read/write operations, are not restricted by source IP. The policy limits model calls from sources outside the allowed list; it does not prevent an insider from routing traffic through an allowed source.

​
Allowed IP rules

  • Supports IPv4 addresses (for example, 203.0.113.5) and IPv4 CIDR ranges (for example, 198.51.100.0/24).
  • IPv6 is not supported yet. If your egress is IPv6, or a dual-stack setup routes through IPv6, the call is rejected.
  • Up to 100 entries per key.
  • An empty allowed list means the source IP is not restricted; this is the default.
Confirm your own egress IP before configuring the policy. When the list is non-empty, every source outside it, including your testing egress, is rejected. With dynamic public IPs, multi-datacenter egress, NAT gateways, or serverless functions, the egress IP can change or include multiple addresses. Use a CIDR range to cover the whole block, or confirm and add all egress IPs.

​
Configure network access

Team admins can configure network access for any key in the team; developers can configure keys they own. Basic members can view the configuration of their own keys but cannot edit it. Billing members have read-only access.
1

Open Key Management

Go to Key Management and find the API key you want to configure.
2

Open network access settings

While creating or editing the key, open the Network Access section.
3

Add allowed IPs

Add allowed IPv4 addresses or CIDR ranges one by one. Leave the list empty to keep the source IP unrestricted.
4

Save

After you save, the new network access settings apply to subsequent calls.

​
When a call is rejected

When an API key invokes a model from a source IP outside the allowed range, the call returns HTTP 403 with the error code ip_access_denied. Confirm the request’s public egress IP and add it to the key’s allowed list, or contact your team admin to adjust the network access policy. See also Common Error Codes.
Last modified on September 1, 2026