IP Filtering (Optional)

Before you start

Make sure you have the following:

How it works

RiskOS™ supports optional IP allowlisting to provide an extra layer of network-level security. Allowlisting restricts access to trusted network ranges — even if valid credentials are presented.

RiskOS™ allows you to define an allowlist for the following:

Configure your allowlist

To configure which IPs or domains can access the APIs:

1. Go to the Developer Workbench > IPs Filtering section in the RiskOS™ Dashboard.
   • 🔗 Manage Sandbox IP allowlist.
   • 🔗 Manage Production IP allowlist.
2. In the API Keys IPs tab, click Add IP/CIDR filter.
3. Enter the IP addresses or domains, separated by commas, into the IP / CIDR field.
4. Click Save.

Supported formats

Allowed

You can allowlist the following types of entries:

• Valid IPv4 addresses (e.g., 203.0.113.42)

• Valid IPv4 addresses with CIDR masks (e.g., 203.0.113.0/24)

• Internet-routable IP addresses only (i.e., no private or loopback IPs)

• Valid domain names including:

  • www.example-domain.com
  • https://www.example-domain.com
  • https://example-domain.com
  • example-domain.com

Not allowed

The following entry types are not allowed:

• Private or loopback IPs:

  • 192.168.1.*
  • localhost
  • 127.0.0.1
  • ::1/128

• Empty strings

Remove an IP address or domain

To remove an entry from the allowlist:

1. Click the trash can icon next to the entry.
2. In the confirmation dialog, click Delete.

RiskOS™ removes the IP address or domain from the allowlist immediately.