KEY_IP_NOT_ALLOWED
The key is used from an address outside its allowlist
The secret key was created with an allowlist of source addresses or CIDR ranges, and this request came from elsewhere.
- http status
- 403
- credits
- Nothing is billed for a failed request.
What it means
An allowlist pins a key to the servers that should hold it, so a leaked key is useless from anywhere else. The address checked is the client address as seen through the trusted proxy in front of the service.
Nothing is billed for a refused request.
What to do
Call from a listed address, or create a key whose allowlist includes the new range. Allowlists are set when a key is created; Rotate on the API keys page issues a replacement carrying the same one, so change the list by creating a new key rather than by rotating.
Example response
{
"success": false,
"error": {
"code": "KEY_IP_NOT_ALLOWED",
"message": "This API key cannot be used from this address. Add the address to the key's allowlist or create a key without one.",
"request_id": "req_01m1kgdm4xngzmbmff68g94w0c"
}
}Every error carries the request_id also sent in the X-Request-Id header; quote it when writing to support.
Related
- ORIGIN_NOT_ALLOWED · the page's origin is not on the key's allowed list
- KEY_ACCOUNT_MISMATCH · the key belongs to an account its holder has left
- KEY_SCOPE_DENIED · the key lacks the scope this endpoint needs
- SANDBOX_ENDPOINT_NOT_ALLOWED · the sandbox key does not answer this endpoint
- SANDBOX_VALUE_NOT_ALLOWED · the sandbox key does not answer for that value
- TURNSTILE_FAILED · the publishable key requires a Cloudflare Turnstile token
- EMAIL_NOT_VERIFIED · the account behind the key has not confirmed its email address
- All error codes
- Verdicts and the risk score
- API reference
markdown version: /docs/errors/KEY_IP_NOT_ALLOWED.md