IP allowlisting

Restrict UI logins, API keys, and self-hosted agents in your env zero organization to approved IPv4 and IPv6 addresses, subnets, and ranges.

An IP allowlist restricts where your organization can be reached from. When your organization has one, env zero accepts the following only from an IP address on the list:

• UI logins, including SSO users who belong to several organizations
• Requests made with an API key, including personal API keys
• Requests from your self-hosted agents to the Agent API

An organization without an allowlist accepts requests from any IP address. This is the default.

You can also give a single API key its own list of allowed IPs. See Allowed IPs for one API key.

This page covers traffic coming into env zero. To let env zero’s outbound traffic reach your VCS or cloud resources, see IP addresses.

How the allowlist is enforced

Access	When env zero checks the IP
UI login	When the user logs in. Users who are already logged in stay logged in when you change the list.
API key	On every request. The key is checked against its own allowed IPs, if it has any, and against the allowlist of every organization it has access to.
Self-hosted agent	On every request to the Agent API.

A user who belongs to several organizations can’t log in from an IP address that any of those organizations’ allowlists excludes. This applies even if their other organizations have no allowlist.

Requests env zero makes during a deployment aren’t checked, such as OIDC token requests and module downloads from the private registry. SaaS agents aren’t checked either. Deployments on env zero-hosted runners keep working when your organization has an allowlist.

If env zero can’t read your organization’s allowlist, it denies the request.

Changes apply to the next login or request. An API key or self-hosted agent that already connected from an IP address you remove can keep working from that address for up to one hour.

Rule format

The allowlist is the ipAllowlist organization policy, a list of rules. A request is allowed if its IP address matches any rule.

type	Required fields	Matches
address	address	A single IP address
subnet	network, prefix	A CIDR block, for example network 198.51.100.0 with prefix 24
range	start, end	Every address from start to end, inclusive

Every rule also takes family, either ipv4 or ipv6. It defaults to ipv4, so set "family": "ipv6" on every IPv6 rule. env zero rejects a rule that is missing a required field or has a field that doesn’t belong to its type.

Set the allowlist

You need the Edit Organization Settings permission, for example an Admin API key.

Include every address you log in and call the API from. If the list excludes them, you lose access to the organization and need to contact support to restore it.

You also need your Organization ID.

1. Send the allowlist

   Call the Update Policy API with your rules:

   curl -X POST "https://api.env0.com/organizations/<ORGANIZATION_ID>/policies" \
     -u "<API_KEY_ID>:<API_KEY_SECRET>" \
     -H "Content-Type: application/json" \
     -d '{
       "ipAllowlist": [
         {"type": "address", "family": "ipv4", "address": "203.0.113.10"},
         {"type": "subnet", "family": "ipv4", "network": "198.51.100.0", "prefix": 24},
         {"type": "range", "family": "ipv4", "start": "192.0.2.10", "end": "192.0.2.20"},
         {"type": "subnet", "family": "ipv6", "network": "2001:db8::", "prefix": 32}
       ]
     }'
   

   The request replaces the whole list. Other organization policies you leave out of the request don’t change.

2. Check the saved list

   The Get Organization API returns the current rules, or null if the organization has no allowlist:

   curl -s -u "<API_KEY_ID>:<API_KEY_SECRET>" \
     "https://api.env0.com/organizations/<ORGANIZATION_ID>" \
     | jq '.ipAllowlist'
   

If you’d rather have env zero configure the allowlist, contact your account team or support.

Remove the allowlist

Send an empty list. The organization accepts requests from any IP address again.

curl -X POST "https://api.env0.com/organizations/<ORGANIZATION_ID>/policies" \
  -u "<API_KEY_ID>:<API_KEY_SECRET>" \
  -H "Content-Type: application/json" \
  -d '{"ipAllowlist": []}'

Allowed IPs for one API key

An API key, including a personal API key, can have its own list of allowed IPs. A request made with the key must come from an address on that list. Organization allowlists still apply, so the address must also be on the allowlist of every organization the key has access to. A key with no list of its own is checked against the organization allowlists only.

A key’s list uses the same rules as the organization allowlist, up to 50 per key. Use a subnet to cover many addresses with one rule.

A key that already connected from an address you remove can keep working from that address for up to one hour.

Set a key’s allowed IPs in env zero

1. Open the key list

   For an organization API key, go to Organization Settings > API Keys. You need the Edit Organization Settings permission.

   For a personal API key, go to Personal settings > Personal API Keys. You can change only your own personal API keys.

2. Enter the allowed IPs

   When you create a key, enter its addresses in Allowed IPs. To change an existing key, click the edit button next to it.

   Each entry is one of:

   • An address, for example 192.0.2.17
   • A subnet, for example 198.51.100.0/28
   • A range, for example 198.51.100.40-198.51.100.60

   IPv6 entries take the same forms. Separate entries with commas, spaces, or new lines, or press Enter after each one. env zero marks an entry it can’t read in red and names it under the field.

3. Save

   Create the key, or click Save in the edit dialog.

The Allowed IPs column shows each key’s list. A key with no list shows Any IP. To remove a key’s list, delete every entry and save.

If env zero creates a key but can’t save its allowed IPs, the screen that shows the new key says so. The key then works from any IP until you set its list with the edit button.

Set a key’s allowed IPs with the API

Each request replaces the key’s whole list. An empty list removes the key’s restriction.

For an organization API key, call Update an API Key IP allowlist. Get the key’s id from List Organization API Keys. It looks like auth0|..., so encode the | as %7C in the URL:

curl -X PUT "https://api.env0.com/api-keys/auth0%7C<KEY_ID_SUFFIX>/ip-allowlist" \
  -u "<API_KEY_ID>:<API_KEY_SECRET>" \
  -H "Content-Type: application/json" \
  -d '{
    "ipAllowlist": [
      {"type": "address", "family": "ipv4", "address": "203.0.113.10"},
      {"type": "subnet", "family": "ipv4", "network": "198.51.100.0", "prefix": 24}
    ]
  }'

For a personal API key, call Update a personal API Key IP allowlist with the key’s id from List personal API keys. Only the key’s owner can change it, so authenticate with one of your own personal API keys:

curl -X PUT "https://api.env0.com/personal-api-keys/<PERSONAL_KEY_ID>/ip-allowlist" \
  -u "<API_KEY_ID>:<API_KEY_SECRET>" \
  -H "Content-Type: application/json" \
  -d '{"ipAllowlist": [{"type": "address", "family": "ipv4", "address": "203.0.113.10"}]}'

Both list endpoints return each key’s current rules in ipAllowlist.

Next steps

• Review the other security controls env zero provides
• Run deployments from inside your own network with a self-hosted agent