> ## Documentation Index
> Fetch the complete documentation index at: https://staging-docs.crosspoint.finance/llms.txt
> Use this file to discover all available pages before exploring further.

# IP allowlist

> Make an API token work only from your servers' IP addresses.

An organization access token with an IP allowlist only works from those addresses. A request with the token from anywhere else is refused, so a leaked token can't be used.

## Set it up

1. Create a token in **Settings > Preferences > Developers**, if you haven't.
2. Open **Settings > IP allowlist**.
3. Next to the token, choose **Limit IPs** and enter your servers' addresses, one per line:

```
41.58.12.7
41.58.12.0/24
2c0f:f248::/32
```

Single addresses and ranges (CIDR), IPv4 and IPv6, up to 50 per token. **Allow any IP** removes the restriction. Only the store's owners and admins can change it, and only from the dashboard: a token can't change its own list.

## What a blocked request gets

```json theme={null}
{
  "error": "TokenIPNotAllowed",
  "detail": "This API token can't be used from 196.1.1.1. Add the address to the token's allowed IPs (dashboard: Settings > IP allowlist)."
}
```

with status `403`. The address in the message is the one Crosspoint saw, so you know what to add.

> [!TIP]
>
> Hosts like Vercel or serverless functions call from changing addresses. Use an allowlist for servers with fixed outbound IPs, or ask your host for its egress ranges.

## Related

* [SDKs](https://staging-docs.crosspoint.finance/africa/sdks.md)
* [Sandbox](https://staging-docs.crosspoint.finance/africa/sandbox.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.