> ## Documentation Index > Fetch the complete documentation index at: https://docs.envzero.com/llms.txt > Use this file to discover all available pages before exploring further. # IP allowlisting > Restrict UI logins, API keys, and self-hosted agents in your env zero organization to approved IPv4 and IPv6 addresses, subnets, and ranges. An IP allowlist restricts where your organization can be reached from. When your organization has one, env zero accepts the following only from an IP address on the list: * UI logins, including SSO users who belong to several organizations * Requests made with an API key, including personal API keys * Requests from your self-hosted agents to the Agent API An organization without an allowlist accepts requests from any IP address. This is the default. You can also give a single API key its own list of allowed IPs. See [Allowed IPs for one API key](#allowed-ips-for-one-api-key). > [!NOTE] > > This page covers traffic coming into env zero. To let env zero's outbound traffic reach your VCS or cloud resources, see [IP addresses](https://docs.envzero.com/guides/overview/security-overview/ip-addresses.md). ## How the allowlist is enforced | Access | When env zero checks the IP | | :- | :- | | UI login | When the user logs in. Users who are already logged in stay logged in when you change the list. | | API key | On every request. The key is checked against its own [allowed IPs](#allowed-ips-for-one-api-key), if it has any, and against the allowlist of every organization it has access to. | | Self-hosted agent | On every request to the Agent API. | A user who belongs to several organizations can't log in from an IP address that any of those organizations' allowlists excludes. This applies even if their other organizations have no allowlist. Requests env zero makes during a deployment aren't checked, such as OIDC token requests and module downloads from the [private registry](https://docs.envzero.com/guides/admin-guide/private-registry.md). SaaS agents aren't checked either. Deployments on env zero-hosted runners keep working when your organization has an allowlist. If env zero can't read your organization's allowlist, it denies the request. Changes apply to the next login or request. An API key or self-hosted agent that already connected from an IP address you remove can keep working from that address for up to one hour. ## Rule format The allowlist is the `ipAllowlist` organization policy, a list of rules. A request is allowed if its IP address matches any rule. | `type` | Required fields | Matches | | :- | :- | :- | | `address` | `address` | A single IP address | | `subnet` | `network`, `prefix` | A CIDR block, for example `network` `198.51.100.0` with `prefix` `24` | | `range` | `start`, `end` | Every address from `start` to `end`, inclusive | Every rule also takes `family`, either `ipv4` or `ipv6`. It defaults to `ipv4`, so set `"family": "ipv6"` on every IPv6 rule. env zero rejects a rule that is missing a required field or has a field that doesn't belong to its type. ## Set the allowlist > [!WARNING] > > You need the **Edit Organization Settings** permission, for example an Admin [API key](https://docs.envzero.com/guides/admin-guide/user-role-and-team-management/api-keys.md). > [!WARNING] > > Include every address you log in and call the API from. If the list excludes them, you lose access to the organization and need to contact [support](mailto:support@env0.com) to restore it. You also need your [Organization ID](https://docs.envzero.com/guides/admin-guide/organizations.md#finding-my-organization-id). **1. Send the allowlist** Call the [Update Policy](https://docs.envzero.com/api-reference/organization/update-policy.md) API with your rules: ```bash theme={null} curl -X POST "https://api.env0.com/organizations//policies" \ -u ":" \ -H "Content-Type: application/json" \ -d '{ "ipAllowlist": [ {"type": "address", "family": "ipv4", "address": "203.0.113.10"}, {"type": "subnet", "family": "ipv4", "network": "198.51.100.0", "prefix": 24}, {"type": "range", "family": "ipv4", "start": "192.0.2.10", "end": "192.0.2.20"}, {"type": "subnet", "family": "ipv6", "network": "2001:db8::", "prefix": 32} ] }' ``` The request replaces the whole list. Other organization policies you leave out of the request don't change. **2. Check the saved list** The [Get Organization](https://docs.envzero.com/api-reference/organization/get-organization.md) API returns the current rules, or `null` if the organization has no allowlist: ```bash theme={null} curl -s -u ":" \ "https://api.env0.com/organizations/" \ | jq '.ipAllowlist' ``` If you'd rather have env zero configure the allowlist, contact your account team or [support](mailto:support@env0.com). ## Remove the allowlist Send an empty list. The organization accepts requests from any IP address again. ```bash theme={null} curl -X POST "https://api.env0.com/organizations//policies" \ -u ":" \ -H "Content-Type: application/json" \ -d '{"ipAllowlist": []}' ``` ## Allowed IPs for one API key An API key, including a personal API key, can have its own list of allowed IPs. A request made with the key must come from an address on that list. Organization allowlists still apply, so the address must also be on the allowlist of every organization the key has access to. A key with no list of its own is checked against the organization allowlists only. A key's list uses the same [rules](#rule-format) as the organization allowlist, up to 50 per key. Use a subnet to cover many addresses with one rule. A key that already connected from an address you remove can keep working from that address for up to one hour. ### Set a key's allowed IPs in env zero **1. Open the key list** For an organization API key, go to **Organization Settings** > **API Keys**. You need the **Edit Organization Settings** permission. For a personal API key, go to **Personal settings** > **Personal API Keys**. You can change only your own personal API keys. **2. Enter the allowed IPs** When you create a key, enter its addresses in **Allowed IPs**. To change an existing key, click the edit button next to it. Each entry is one of: * An address, for example `192.0.2.17` * A subnet, for example `198.51.100.0/28` * A range, for example `198.51.100.40-198.51.100.60` IPv6 entries take the same forms. Separate entries with commas, spaces, or new lines, or press Enter after each one. env zero marks an entry it can't read in red and names it under the field. **3. Save** Create the key, or click **Save** in the edit dialog. The **Allowed IPs** column shows each key's list. A key with no list shows **Any IP**. To remove a key's list, delete every entry and save. If env zero creates a key but can't save its allowed IPs, the screen that shows the new key says so. The key then works from any IP until you set its list with the edit button. ### Set a key's allowed IPs with the API Each request replaces the key's whole list. An empty list removes the key's restriction. For an organization API key, call [Update an API Key IP allowlist](https://docs.envzero.com/api-reference/credentials/update-an-api-key-ip-allowlist.md). Get the key's `id` from [List Organization API Keys](https://docs.envzero.com/api-reference/credentials/list-organization-api-keys.md). It looks like `auth0|...`, so encode the `|` as `%7C` in the URL: ```bash theme={null} curl -X PUT "https://api.env0.com/api-keys/auth0%7C/ip-allowlist" \ -u ":" \ -H "Content-Type: application/json" \ -d '{ "ipAllowlist": [ {"type": "address", "family": "ipv4", "address": "203.0.113.10"}, {"type": "subnet", "family": "ipv4", "network": "198.51.100.0", "prefix": 24} ] }' ``` For a personal API key, call [Update a personal API Key IP allowlist](https://docs.envzero.com/api-reference/credentials/update-a-personal-api-key-ip-allowlist.md) with the key's `id` from [List personal API keys](https://docs.envzero.com/api-reference/credentials/list-users-personal-api-keys-endpoint.md). Only the key's owner can change it, so authenticate with one of your own personal API keys: ```bash theme={null} curl -X PUT "https://api.env0.com/personal-api-keys//ip-allowlist" \ -u ":" \ -H "Content-Type: application/json" \ -d '{"ipAllowlist": [{"type": "address", "family": "ipv4", "address": "203.0.113.10"}]}' ``` Both list endpoints return each key's current rules in `ipAllowlist`. ## Next steps * [Review the other security controls](https://docs.envzero.com/guides/overview/security-overview.md) env zero provides * [Run deployments from inside your own network](https://docs.envzero.com/guides/admin-guide/self-hosted-kubernetes-agent/overview.md) with a self-hosted agent This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.