Endpoint IP allowlist

How it works

Empty allowlist (default): requests from any client IP are accepted.

Non-empty allowlist: the gateway accepts only listed IPs. Everyone else receives HTTP 403.

How to configure in the dashboard

1. Open the dashboard → Endpoints and select an endpoint.
2. Open the Settings tab.
3. Add IPv4 or IPv6 addresses (up to 50), then click Save changes.
4. To allow all IPs again, remove every address from the list and save.

Formats and limits

IPv4 and IPv6 are supported. Addresses are trimmed and deduplicated on save. CIDR ranges are not supported — use exact IPs. Maximum 50 addresses per endpoint.

Which IP is checked

The gateway resolves the real client IP behind Cloudflare / CDN / trusted proxies (not the proxy hop).

When the peer is trusted or CDN headers are enabled, the gateway prefers CF-Connecting-IP and True-Client-IP, then the first public X-Forwarded-For / X-Real-IP value; otherwise it uses RemoteAddr.

Blocked response

If the client IP is not on the allowlist, the gateway returns HTTP 403 with JSON-RPC error code -32000.

Example response

HTTP/1.1 403 Forbidden
Content-Type: application/json

{
  "jsonrpc": "2.0",
  "id": null,
  "error": {
    "code": -32000,
    "message": "client IP is not allowed for this endpoint"
  }
}

Notes

• Leave the list empty if you do not need IP restriction.
• Add the IP your traffic actually comes from (server egress / NAT), not a private LAN address behind NAT unless that is what the gateway sees.
• At most 50 IPs per endpoint; duplicates are dropped when you save.
• IP allowlist is enforced before RPS limiting and upstream forwarding.