> ## Documentation Index
> Fetch the complete documentation index at: https://docs.anchorage.com/llms.txt
> Use this file to discover all available pages before exploring further.

# IP address allowlist

> Restrict platform access to approved IP addresses and CIDR ranges.

Manage the IP allowlist to restrict access to your organization's platforms to approved IP addresses and CIDR ranges. This guide covers adding IP entries, activating enforcement safely, and monitoring changes across each platform.

Managing the IP allowlist requires organization admin access.

## Before you activate the allowlist

Add all required IPs as inactive entries first—including your current IP—before activating enforcement. This prevents lockouts and keeps access uninterrupted for current users while you finish setup.

<Warning>
  Activate the allowlist only after an active IP entry covers your current IP. Otherwise, you can lock yourself out. The platform then shows an **Access denied** screen with your IP address and a prompt to contact your organization admin.
</Warning>

## Add and activate IP entries

1. **Add an IP entry** — Select **Add IP address**.
2. **Enter the IP address or CIDR range** — Use a single IPv4 address (e.g., `203.0.113.5`) or a CIDR range (e.g., `203.0.113.0/24`). The allowlist supports IPv4 addresses only.
3. **Add a label** — Optionally add a name such as `HQ Office` or `VPN gateway` so you can find the entry later.
4. **Choose platforms** — Select which platforms the entry applies to. Use **Select all** to cover all available platforms.
5. **Set the status** — Choose **Inactive** while you finish building the list, or **Active** to allow access immediately.
6. **Activate enforcement** — Toggle an IP entry on from the **Active** column. The first active IP entry starts enforcement for the platforms selected on it.

<Note>
  A platform stays open to all IPs until it has at least one active IP entry. Once a platform has an active IP entry, only IP addresses covered by active entries for that platform can access it. All other IPs are blocked. For example, if you activate an entry for the web dashboard but not for the REST API, only the web dashboard is restricted.
</Note>

A confirmation modal appears when you activate the first IP entry for a platform, and when an action removes the last active entry covering a platform.

## Update or remove IP entries

Select any IP entry in the table to open the edit modal. You can update the IP address, label, platforms, or status. The same validation and confirmation checks apply as when adding a new entry.

To remove an IP entry, open the **⋮** menu on that row and select **Remove**. For active entries, the confirmation modal includes a **Disable instead** option so you can turn the entry off without removing it permanently.

## Bulk actions

Use the **⋮** menu above the table to run bulk operations:

* **Activate all entries** — Activates all inactive IP entries at once.
* **Deactivate all entries** — Deactivates all active IP entries at once.
* **Remove all entries** — Permanently removes all IP entries.

Each bulk action shows a confirmation modal before it runs.

## Bulk import IP entries with CSV

Select **Import CSV** to add multiple IP entries at once.

1. **Upload** — Select a CSV file with columns for IP, Label, Platforms, and Status.
2. **Preview and validate** — Review row-level errors such as invalid IPs, duplicates, or reserved addresses, and warnings for CIDR ranges that are too broad.
3. **Confirm and import** — Review the summary and confirm the import.

## Monitor platform coverage

Status chips at the top of the page show whether each platform is restricted and how many active IP entries cover it.

* **Restricted (blue)** — At least one active IP entry covers this platform, showing the count, such as `Web dashboard — 3 active entries`.
* **Open to all IPs (grey)** — No active IP entries cover this platform. All IPs can access it freely.

These chips update in real time as you add, remove, or toggle IP entries.

## Review the audit log

Open the **Audit log** tab to review the full history of changes made to the allowlist, including who made each change and when.

Every action is recorded: adding, removing, editing, activating, and deactivating IP entries, as well as bulk operations. Bulk actions are recorded as individual entries per IP, marked with a suffix such as `via Activate all` or `via Bulk import` for traceability.

## Email notifications

All organization admins receive a daily email digest when significant changes are made to the allowlist. The email includes:

* A notice that changes were made.
* The current platform status, including which platforms are restricted and how many IP entries cover each.
* A link to the allowlist page to review details in the audit log.

For specific IP addresses and details of what changed, check the audit log directly.

## Access denied behavior

If your IP is not authorized to access a platform, you'll see an **Access denied** screen showing your IP address and a message to contact your organization admin.

This applies across all platforms:

| Platform | Behavior |
| :- | :- |
| Web dashboard and iOS app | Full-screen blocked page |
| Browser extension | Blocked message within the extension |
| REST API | HTTP `403` response with error code `ip_not_allowed` |

## Validation rules

The following are not allowed in the allowlist:

* **Reserved IP addresses** — Includes loopback, private ranges, broadcast, link-local, and `0.0.0.0/0`.
* **Duplicate IPs** — An entry with the exact same IP address already exists.
* **Invalid format** — The IP address or CIDR notation is not valid.

Very broad CIDR ranges such as `/8` show a warning but are still allowed.

## Tips

* Add all IPs as inactive first, then activate them once your full list is ready.
* Always include your own IP before activating the allowlist.
* Use labels to make IP entries easier to recognize later.
* Use CSV import when you need to add many entries at once.
* Check the platform status chips after making changes to confirm each platform has the coverage you expect.


## Related topics

- [FAQs](/knowledge-base/porto/developers/faqs.md)
- [Reporting overview](/knowledge-base/platform/developers/reporting/overview.md)
- [Key download preferences](/knowledge-base/porto/security/key-download-preferences.md)
- [Trusted destinations](/knowledge-base/porto/developers/move-money/setup/trusted-destinations.md)