Restrict access by IP address

IP restrictions decide where calls to a gateway can come from. You can set an allowlist, a blocklist and a list of blocked countries for a whole environment, and again for one key or user. The gateway checks them on every request, before anything else.

Restrict an environment

To restrict every credential of an environment:

In the portal, go to Agent Gateway and select your gateway.
Select the Policies tab and go to IP Restrictions.
In IP allowlist, enter the addresses that can reach the gateway, one IP address or CIDR range per line. IPv4 and IPv6 are accepted. Leave it empty to allow any address.
In IP blocklist, enter the addresses to refuse, one per line.
Under Blocked countries, turn on each country to refuse.
Select Save changes.

203.0.113.10
10.0.0.0/8
2001:db8::/32

Warning

An allowlist applies to every client of the environment at once. A person on claude.ai or ChatGPT calls from that service's servers, not from their own network, so an allowlist with only your office range refuses them.

Restrict one key or user

To restrict a single credential:

In the gateway's Access tab, select API keys or Users, and select the credential.
Go to IP Restrictions and fill in the same three fields.
Select Save changes.

The allowlist is checked on every call. It does not apply to the sign-in page.

The credential's lists are added to the environment's. A call has to pass both. Countries blocked by the environment appear on the credential as Blocked by the environment and cannot be turned off there.

How the lists combine

Rule	Result
The address is on a blocklist	Refused with `ip_blocked`, even if it is also on an allowlist.
The address belongs to a blocked country	Refused with `ip_blocked`.
An allowlist is set and the address is not on it	Refused with `ip_not_allowed`.
No allowlist is set	Any address that is not blocked is accepted.

Over REST the refusal is a 403. The request appears in the gateway's Logs tab as denied, with the caller's address in the message.

Blocked countries

The list holds four countries: Cuba, Iran, North Korea and Syria. All four are blocked by default on every gateway, and you can turn any of them off.

Troubleshooting

Symptom	Cause	Fix
`Denied (ip_not_allowed): This gateway cannot be reached from <address>`	The environment has an allowlist and the caller is not on it.	Add the address shown in the message, or clear the allowlist.
`Denied (ip_not_allowed): This key cannot be used from <address>`	The key has an allowlist and the caller is not on it.	Add the address to the key's IP allowlist.
`Denied (ip_blocked): This gateway is blocked from <country>`	The caller's address belongs to a blocked country.	Turn the country off under Blocked countries if the block is not intended.

Next steps

Limits and quotas: rate, quota and concurrency limits.
Logs: find denied requests and their reason.
Gateway HTTP: the error codes a client receives.