Claude Console IP Allowlist: Lock API Keys to Your Networks (Beta)

Last updated: November 5, 2026

As of November 5, 2026, a Claude Platform organization can restrict its API keys to the networks it trusts. An admin turns on the IP allowlist in the Claude Console and adds up to 1,000 public IPv4 or IPv6 addresses or CIDR ranges. Covered requests from any other address get a 403. The feature is in beta. Anthropic's pitch is blunt: "if an API key is leaked, it is much harder for an attacker to use the key." Claude Enterprise organizations get their own allowlist for claude.ai, the apps and Claude Code sign-ins.

Everything below is from the IP allowlisting docs and the Claude Platform release notes, read November 5, 2026.

Official Sources#

Why it matters#

A Claude API key has been a bearer token: whoever holds it can spend your money from anywhere. An allowlist ties that spending to your own egress addresses: your data center, CI and VPN. A key pasted into a public repo or a leaked .env becomes useless from the attacker's laptop.

Anthropic also says what the allowlist does not do: "An allowlist limits where a key works, but not for how long." The docs recommend pairing it with a short key expiration, or moving to Workload Identity Federation to stop using static keys, and call that "safer than allowlisting alone." It belongs on the same list as the controls in our agent security checklist.

%% title: How the Claude Console IP allowlist decides a covered API request
flowchart TD
  A["Request with an API key or WIF token"] --> B{"Covered endpoint?"}
  B -->|"No, e.g. Bedrock or Foundry"| C["Allowlist not applied"]
  B -->|"Yes"| D{"Public source IP in the org list?"}
  D -->|"Yes"| E["Request proceeds"]
  D -->|"No"| F["403 permission_error"]

What it covers#

For a Claude Platform organization, per the docs:

• The Claude Console UI.
• Claude API: Messages, Message Batches, Token Counting, Models, Files and Skills, with an API key or a Workload Identity Federation token.
• Claude Managed Agents: Agents, Sessions, Environments, Vaults and Memory stores.
• Organization APIs: the Admin API and the Compliance API, with a key that covers only this organization.

It does not apply to Claude on Amazon Bedrock, Claude Platform on AWS, Claude Models on Google Cloud or Claude in Microsoft Foundry. For Managed Agents, it covers your requests to the endpoints, "not the agents themselves". It "doesn't apply to any networking in the Claude Managed Agents runtime."

For a Claude Enterprise organization, a separate allowlist covers:

• Claude on the web, desktop and mobile
• Claude Code when users sign in with their Claude account
• Claude in Chrome, the Office add-ins, Cowork and Remote Tools
• the Admin and Compliance APIs

Claude Design, Claude in Slack and Claude Academy aren't covered.

Set it up#

1. Turn it on. In the Claude Console, open the Identity and access page and turn on the IP allowlist toggle. Nothing changes until you save. Enterprise owners use claude.ai > Organization settings > Organization and access.
2. Add every network, then save. Click Add entry, enter addresses or ranges separated by commas, and press Enter. Include your servers, CI, offices, VPNs and the address you are on now. Select Allow admins to access this settings page from any IP address, then click Save and confirm.
3. Watch for 403s. Changes can take up to 15 minutes to apply. Watch your applications for 403 permission_error responses, "including jobs that run only daily or weekly", and add any address you missed.

Entry rules:

• A single address (203.0.113.5) or a CIDR range (203.0.113.0/24, 2001:db8::/32).
• No broader than /8 for IPv4 or /32 for IPv6.
• Up to 1,000 entries.
• Public egress addresses only, not private ranges such as 10.0.0.0/8.

Handle the 403 in code#

A blocked request to the Messages API returns a 403 permission_error with the message Your IP address isn't in this organization's allowed range. In the Anthropic Python SDK that is a PermissionDeniedError, so you can tell an allowlist block apart from other permission problems:

import anthropic

client = anthropic.Anthropic()

ALLOWLIST_MESSAGE = "Your IP address isn't in this organization's allowed range."

try:
    client.messages.create(
        model="claude-opus-5-5",
        max_tokens=256,
        messages=[{"role": "user", "content": "ping"}],
    )
except anthropic.PermissionDeniedError as err:
    # 403 permission_error. With an IP allowlist on, this is the message to look for.
    if ALLOWLIST_MESSAGE in str(err):
        print("Blocked by the IP allowlist: add this host's public egress address.")
    else:
        raise

This passes Pyright in strict mode against anthropic 2.4.0, where PermissionDeniedError subclasses APIStatusError with status 403. Do not retry it: a 403 from the allowlist fails the same way every time. Our Claude API error handling guide covers which errors are worth retrying. We had no organization with the allowlist enabled, so we did not trigger the block ourselves. The message text is copied from the docs.

Gotchas#

You can lock out your own automation. The save step checks only your current address. The docs warn it "does not check your servers, your teammates, or the address you might connect from tomorrow." Before you save, list every place a key is used. That includes the workers of any self-hosted sandboxes, with both IPv4 and IPv6 egress.

The admin escape hatch is a tradeoff. Allow admins to access this settings page from any IP address prevents lockout. The docs note the downside: an attacker who takes over an admin's session "could update the allowlist from a remote location." If you have the Compliance API, its Activity Feed records allowlist changes, so you can audit them.

Shared proxies weaken it. If you list a shared proxy address, the docs warn that someone with a leaked key "could potentially use it through the proxy."

Third-party clouds are out of scope. Traffic through Bedrock, Google Cloud, Foundry or Claude Platform on AWS is not checked. Use those providers' own network controls.

Enterprise users off the VPN are blocked. Phones on mobile data, home Wi-Fi and laptops off the VPN can't reach the organization until they connect through a listed network. If your proxy sends bridge.claudeusercontent.com out through a different address from claude.ai and api.anthropic.com, list that address too.

If you do get locked out, reconnect from a listed network, ask another admin to add your address, or use the escape hatch if you enabled it. Failing that, Anthropic support can turn the allowlist off.

Also shipped November 5: sign a member out everywhere#

The same release notes add a beta Admin API endpoint for Claude Enterprise: POST /v1/organizations/users/{user_id}/sign_out, with the admin-user-sign-out-2026-10-08 beta header. It ends the member's sign-in sessions and trusted devices on every browser and device, along with their OAuth tokens for the organization. The member stays in the organization and can sign in again right away. Paired with the Enterprise allowlist, it covers the stolen-laptop case. If you already script org admin with Anthropic's admin APIs, as in our Usage and Cost Analytics API guide, the same key-scope rules apply. See Sign a member out everywhere for the scope it needs.

What people are actually saying#

• The allowlist and its docs landed on November 5, 2026. We found no Hacker News or Reddit thread about it yet.
• The likely reaction is that this is overdue. IP restrictions are a standard enterprise control, and Anthropic's docs steer teams toward short-lived keys or Workload Identity Federation as the stronger fix.

FAQ#

What does the Claude Console IP allowlist do?#

It restricts covered Claude services to the public IP addresses and CIDR ranges you list, so a leaked API key is much harder to use. It is in beta as of November 5, 2026.

Which Claude API endpoints does the IP allowlist cover?#

The Console UI, Messages, Message Batches, Token Counting, Models, Files, Skills, the Managed Agents endpoints, and the Admin and Compliance APIs. Not Bedrock, Claude Platform on AWS, Google Cloud or Foundry.

What error does a blocked request return?#

A 403 permission_error: "Your IP address isn't in this organization's allowed range." The Python SDK raises PermissionDeniedError.

How many entries can a Claude IP allowlist hold?#

Up to 1,000 public IPv4 or IPv6 addresses or CIDR ranges, no broader than /8 (IPv4) or /32 (IPv6).

What if I lock myself out?#

Reconnect from a listed network, ask another admin, use the admin escape hatch if you enabled it, or contact Anthropic support. Changes take up to 15 minutes.

Continue Reading#

• Claude Usage and Cost Analytics API: Attribute Spend by Key and User - see which keys are spending, before and after you lock them down
• Claude API Reliability: Error Handling Best Practices - which errors to retry and which to surface
• The Agent Security Checklist I Use Before Connecting Tools - where network controls fit in agent security

Sources#

• Claude docs: IP allowlisting
• Claude Platform release notes
• Claude docs: Key expiration
• Claude docs: Workload Identity Federation
• Claude docs: Sign a member out everywhere
• anthropic on PyPI