Your API username and password are powerful: whoever has them can spend your daily hits and wallet balance. IP whitelisting adds a second lock. Even if the credentials leak, calls from any other IP address are rejected.
How it works
In your dashboard open API & IP Whitelist and enter the public IP address of the server that calls the API. From then on, requests from any other address receive the message "This IP address is not whitelisted for your account.". Leave the field empty to allow any IP.
Set it up in four steps
- Find your server's public IP: run
curl https://api.ipify.orgon the server. - Paste it into the whitelist field. Add more addresses separated by commas if you use several servers (maximum 10).
- Save. We validate every address, so a typo is rejected instead of locking you out.
- Test from the server with a free call such as
usageStatus.
Common mistakes
- Adding your own laptop's IP. Use the IP of the machine that makes the API call. Your browser IP is shown only for reference.
- Dynamic IPs. Shared hosting and home connections can change address. Prefer a static IP or a fixed outbound IP from your cloud provider.
- Forgetting a second server. Add staging and failover servers before you need them.
Keep credentials safe too
Whitelisting complements, not replaces, good habits: never put the API password in a mobile app or browser JavaScript, call the API from your backend only, and change your password if you suspect exposure. For more production tips read caching and daily limits.
Frequently asked questions
What if I leave the whitelist empty?
The API accepts calls from any IP address. It is convenient for testing but weaker for production.
How many IP addresses can I add?
Up to 10, separated by commas.
Ready to build?
Create an account, pick a plan and make your first call today. Every plan includes every endpoint.
Create account Read the docs
