> ## Documentation Index
> Fetch the complete documentation index at: https://docs-provider.voucher.allride.io/llms.txt
> Use this file to discover all available pages before exploring further.

# IP allowlist

> Restrict which addresses may call the API with your credentials.

## How the allowlist works

Your partner has a list of up to **100 CIDR blocks**. When enforcement is on, a request whose source address is outside every block is refused with 403 `ip-not-allowed`, and the denial is recorded in your [audit log](https://docs-provider.voucher.allride.io/workspace/audit-log.md) as `security.ip-denied`.

The address checked is the original client address of the connection, as reported by Cloudflare, which fronts the API host (`CF-Connecting-IP`): your **outbound NAT or proxy address**, not a private address inside your network and not a Cloudflare address. Headers you send yourself, such as `X-Forwarded-For`, `X-Real-IP` or `CF-Connecting-IP`, are ignored or overwritten.

Enforcement is the partner setting `ipAllowlistEnforcement`:

| Value | Effect |
| - | - |
| `off` (default) | No checks |
| `api-keys` | API key requests are checked |
| `api-keys-and-users` | API key requests and dashboard users are checked |

Enforcement is effective only with at least one entry, and changes reach every server within 60 seconds.

## Add your IP ranges

Manage entries on the [IP allowlist page](https://provider-developers.voucher.allride.io/go/ip-allowlist) of the developer dashboard. The `/partner/v1/ip-allowlist` operations accept only signed-in users (recent sign-in); API keys can read the list with `view-ip-allowlist`.

```bash theme={null}
curl -sS "$VOUCHER_API_BASE_URL/partner/v1/ip-allowlist" \
  -H "Authorization: Bearer $VOUCHER_API_KEY"
```

Rules for an entry:

* IPv4 prefix /8 or longer, IPv6 prefix /32 or longer, in canonical form (host bits zero), for example `203.0.113.0/24` or `2001:db8:1200::/40`;
* no private, loopback or link-local ranges (item code `invalid-cidr`);
* a label of 1-80 characters; the same CIDR twice → 409 `ip-allowlist-entry-exists`; a 101st entry → 422 `ip-allowlist-limit-reached`.

## Enable enforcement

1. Add **every** egress range of the systems that call the API, IPv4 and IPv6.
2. Call the API from each system and check that it still works.
3. Set enforcement in the dashboard (`PATCH /partner/v1/partner/settings`, `manage-settings`, dashboard only).

Safety rules:

* Enabling enforcement with no entry, or deleting the last entry while enforcement is on → 409 `ip-allowlist-required`.
* With `api-keys-and-users`, a change that would exclude your own current address → 422 `ip-allowlist-would-lock-out`.

## IPv6

The API host resolves to IPv4 and IPv6 addresses (Cloudflare's). If your systems have IPv6 connectivity, they may connect over IPv6 and be refused when only IPv4 ranges are listed. Add your IPv6 egress range, or force IPv4 in your HTTP client (for example `curl -4`).

## Troubleshooting

* **403 `ip-not-allowed` from a server that should be allowed**: check the outbound address with a request from that server to a "what is my IP" service, including IPv6.
* **The docs playground fails**: the playground runs from Mintlify's servers, so it is refused while enforcement covers API keys. Use `curl` from an allowed address.
* **Cloud functions or autoscaling workers**: route them through a NAT with fixed addresses.
* **Locked out of the dashboard** with `api-keys-and-users`: another member on an allowed network can change the setting; otherwise contact AllRide support.

## Related

* [Network and IP addresses](https://docs-provider.voucher.allride.io/guides/network.md)
* [Authentication](https://docs-provider.voucher.allride.io/guides/authentication.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.