> ## Documentation Index
> Fetch the complete documentation index at: https://docs.novita.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Network Access for API Keys

A network access policy restricts which source IPs can use an individual API key. Once configured, only IPs in the allowed list can use the key to invoke models; requests from other sources are rejected.

A network access policy is configured per key, and policies are independent. An empty allowed list does not restrict the source IP.

<Info>
  Network access applies only to model invocation. Management endpoints, including billing queries and key policy read/write operations, are not restricted by source IP. The policy limits model calls from sources outside the allowed list; it does not prevent an insider from routing traffic through an allowed source.
</Info>

## Allowed IP rules

* Supports IPv4 addresses (for example, `203.0.113.5`) and IPv4 CIDR ranges (for example, `198.51.100.0/24`).
* **IPv6 is not supported yet.** If your egress is IPv6, or a dual-stack setup routes through IPv6, the call is rejected.
* Up to 100 entries per key.
* An empty allowed list means the source IP is not restricted; this is the default.

<Warning>
  Confirm your own egress IP before configuring the policy. When the list is non-empty, every source outside it, including your testing egress, is rejected. With dynamic public IPs, multi-datacenter egress, NAT gateways, or serverless functions, the egress IP can change or include multiple addresses. Use a CIDR range to cover the whole block, or confirm and add all egress IPs.
</Warning>

## Configure network access

<Note>
  Team admins can configure network access for any key in the team; developers can configure keys they own. Basic members can view the configuration of their own keys but cannot edit it. Billing members have read-only access.
</Note>

<Steps>
  <Step title="Open Key Management">
    Go to [Key Management](https://novita.ai/settings/key-management) and find the API key you want to configure.
  </Step>

  <Step title="Open network access settings">
    While creating or editing the key, open the **Network Access** section.
  </Step>

  <Step title="Add allowed IPs">
    Add allowed IPv4 addresses or CIDR ranges one by one. Leave the list empty to keep the source IP unrestricted.
  </Step>

  <Step title="Save">
    After you save, the new network access settings apply to subsequent calls.
  </Step>
</Steps>

## When a call is rejected

When an API key invokes a model from a source IP outside the allowed range, the call returns HTTP 403 with the error code `ip_access_denied`. Confirm the request's public egress IP and add it to the key's allowed list, or contact your team admin to adjust the network access policy. See also [Common Error Codes](/guides/error).

## Related

* [API Keys](/guides/llm-api-keys) — create, store, and manage API keys, including expiration and OpenAPI boundaries.
* [Model Access for API Keys](/guides/llm-model-access) — restrict which models a key can call.
* [Get API Key IP Access Policy](/api-reference/key-get-ip-access-policy) — read a key's network access policy programmatically.