Accounting APIv1

IP allowlist

A key can optionally restrict the source IPs that may use it. When a key carries a non-empty allowed_ips list, a request whose client IP is not permitted is rejected with the same opaque 401 as any other auth failure (see API keys).

What allowed_ips accepts

Each entry is one of:

  • a bare IPv4 or IPv6 literal (exact match), or
  • an IPv4 CIDR range in a.b.c.d/n form (containment match).
{
  "allowed_ips": ["203.0.113.7", "198.51.100.0/24", "2001:db8::1"]
}

IPv6 is matched by exact literal only — IPv6 CIDR ranges are not supported (an ipv6/nn entry would never match, so it is rejected at save time rather than silently failing open).

Fail-closed on an unknown source IP

The platform only trusts a forwarded client IP when it sits behind a proxy/edge it has been explicitly configured to trust (and which overwrites the forwarded-for header with the real connecting peer). A client-supplied X-Forwarded-For is otherwise ignored — it cannot be used to spoof an allowlisted address.

No trusted edge means no client IP

If the deployment has not configured a trusted proxy, the request IP is treated as unknown, and a key that carries an allowed_ips list fails closed (is rejected). Keys without an allowlist are unaffected — their IP is never consulted.