Eveses, on your own account settings.
ip_not_allowed — your IP is not on the allowlist
Our API refused the request because IP allowlisting is enabled on your account and the address you called from is not on the list. This is our error, not a target's, and it is a setting you control.
A proxy does not fix this. Routing the call through a proxy makes this more likely rather than less, because the address we check is then the exit node's. Call the API directly and use the proxy for the traffic it is for.
Why it happens
The allowlist was enabled and this machine, container or CI runner was never added.
The calling machine's address changed — a dynamic home IP, a new deploy, an autoscaled worker.
The request came through a proxy, so we saw the exit IP rather than the machine you expected.
How to fix it
- Add the calling address in the cabinet under Security, or clear the allowlist if the account is protected by key rotation instead.
- For autoscaled workers, allowlist the NAT gateway rather than each instance.
- Remember that calling our API THROUGH a proxy means we see the proxy's address, not yours.
FAQ
What does ip_not_allowed mean?›
Our API refused the request because IP allowlisting is enabled on your account and the address you called from is not on the list. This is our error, not a target's, and it is a setting you control. Eveses, on your own account settings.
Why am I getting ip_not_allowed?›
The allowlist was enabled and this machine, container or CI runner was never added. The calling machine's address changed — a dynamic home IP, a new deploy, an autoscaled worker. The request came through a proxy, so we saw the exit IP rather than the machine you expected.
How do I fix ip_not_allowed?›
Add the calling address in the cabinet under Security, or clear the allowlist if the account is protected by key rotation instead. For autoscaled workers, allowlist the NAT gateway rather than each instance. Remember that calling our API THROUGH a proxy means we see the proxy's address, not yours.
Will a proxy fix ip_not_allowed?›
Routing the call through a proxy makes this more likely rather than less, because the address we check is then the exit node's. Call the API directly and use the proxy for the traffic it is for.