IP allowlist - Crosspoint

An organization access token with an IP allowlist only works from those addresses. A request with the token from anywhere else is refused, so a leaked token can’t be used.

Set it up

Create a token in Settings > Preferences > Developers, if you haven’t.
Open Settings > IP allowlist.
Next to the token, choose Limit IPs and enter your servers’ addresses, one per line:

41.58.12.7
41.58.12.0/24
2c0f:f248::/32

Single addresses and ranges (CIDR), IPv4 and IPv6, up to 50 per token. Allow any IP removes the restriction. Only the store’s owners and admins can change it, and only from the dashboard: a token can’t change its own list.

What a blocked request gets

{
  "error": "TokenIPNotAllowed",
  "detail": "This API token can't be used from 196.1.1.1. Add the address to the token's allowed IPs (dashboard: Settings > IP allowlist)."
}

with status 403. The address in the message is the one Crosspoint saw, so you know what to add.

Hosts like Vercel or serverless functions call from changing addresses. Use an allowlist for servers with fixed outbound IPs, or ask your host for its egress ranges.

SDKs
Sandbox

⌘I