Platform / Güvenlik / IP Allowlist
Güvenlik

IP İzin Listesi

Restrict API access to a set of trusted IP addresses or CIDR ranges. Protect your organization's API keys from unauthorized use even if credentials are compromised.

Important: Enabling an IP allowlist will block all API requests from unlisted IPs, including your current session if not included. Verify your own IP is in the list before enabling.
Scope: IP allowlists apply to API requests only, not the GlomaxGPT dashboard or platform web UI.

Genel Bakış

An IP allowlist is a security control that restricts which IP addresses can make successful API calls to GlomaxGPT on behalf of your organization. Requests from IPs not on the list receive a 403 Forbidden response, regardless of whether they carry a valid API key.

Organization-level allowlist

Applies to all projects and API keys within your organization. Provides a blanket control for your entire account. Any request to any project under your org must originate from an allowlisted IP.

Project-level allowlist

Scoped to a specific project. Useful when different teams or services need different access controls. If both org-level and project-level allowlists are set, both must permit the IP.

How it works

When an IP allowlist is active, the GlomaxGPT API gateway checks the source IP of every inbound request against your configured list before processing the request or validating the API key.

1

Request arrives at the API gateway

The gateway records the source IP of the incoming request. If your service is behind a proxy or load balancer, ensure it forwards the correct X-Forwarded-For header so the gateway sees the real client IP.

2

IP is checked against the allowlist

The source IP is evaluated against all configured CIDR ranges and individual IP entries for the organization and project. If the IP falls within any listed range, the request proceeds.

3

Allowed: normal processing continues

If the IP is permitted, the request continues through normal API processing — API key validation, rate limiting, and model inference.

4

Blocked: 403 returned immediately

If the IP is not on the allowlist, a 403 Forbidden response is returned immediately. The API key is never evaluated, and no tokens are consumed.

Bypass considerations

  • The allowlist does not apply to the GlomaxGPT web dashboard or GlomaxGPT.
  • Internal GlomaxGPT health checks and monitoring traffic are always permitted.
  • Playground requests originate from GlomaxGPT's infrastructure, not your browser — they may be blocked if your allowlist is restrictive.
  • Webhooks sent by GlomaxGPT to your endpoints are outbound from GlomaxGPT, not subject to your allowlist.

Configuring via the dashboard

Organization owners and admins can manage the IP allowlist from the Security settings page in the GlomaxGPT Platform dashboard.

1

Navigate to Settings → Security

Log in to platform.glomaxgpt.com, go to your organization settings, and select the Güvenlik tab from the left navigation panel.

2

Open the IP Allowlist section

Scroll to the IP Allowlist card. Your current IP address will be displayed as a reference. Confirm it is an address you intend to keep access from.

3

Add your IP addresses or CIDR ranges

Click Add entry and enter individual IPs (e.g. 203.0.113.42) or CIDR ranges (e.g. 203.0.113.0/24). Add a description for each entry to track its purpose. Repeat for all trusted IPs.

4

Enable the allowlist

Toggle Enable IP Allowlist to on. Changes take effect within seconds. Requests from unlisted IPs will immediately begin receiving 403 responses. Review your list once more before saving.

Configuring via the Admin API

Use the Admin API to manage IP allowlist entries programmatically. This is useful for automating security policy updates through your infrastructure-as-code workflows.

manage-allowlist.py 
import requests

ADMIN_API_KEY = "your-admin-api-key"
ORG_ID = "org-xxxxxxxxxxxx"
BASE_URL = f"https://api.glomaxgpt.com/v1/organizations/{ORG_ID}"

headers = {
    "Authorization": f"Bearer {ADMIN_API_KEY}",
    "Content-Type": "application/json"
}

# List current allowlist entries
response = requests.get(
    f"{BASE_URL}/ip_allowlist",
    headers=headers
)
print(response.json())

# Add a new CIDR entry
response = requests.post(
    f"{BASE_URL}/ip_allowlist/entries",
    headers=headers,
    json={
        "cidr": "203.0.113.0/24",
        "description": "Production server subnet"
    }
)
entry = response.json()
print(f"Added entry: {entry['id']}")

# Remove an entry by ID
requests.delete(
    f"{BASE_URL}/ip_allowlist/entries/{entry['id']}",
    headers=headers
)
print("Entry removed.")
manage-allowlist.sh 
# List current entries
curl https://api.glomaxgpt.com/v1/organizations/org-xxxx/ip_allowlist \
  -H "Authorization: Bearer $ADMIN_API_KEY"

# Add a CIDR entry
curl https://api.glomaxgpt.com/v1/organizations/org-xxxx/ip_allowlist/entries \
  -X POST \
  -H "Authorization: Bearer $ADMIN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "cidr": "203.0.113.0/24",
    "description": "Production server subnet"
  }'

# Remove an entry
curl https://api.glomaxgpt.com/v1/organizations/org-xxxx/ip_allowlist/entries/entry_abc123 \
  -X DELETE \
  -H "Authorization: Bearer $ADMIN_API_KEY"

CIDR notation

CIDR (Classless Inter-Domain Routing) notation lets you specify a range of IP addresses using a base address and a prefix length. This is the recommended way to allowlist subnets.

Entry Type Covers
203.0.113.42 Single IP Exactly one address — ideal for a single server or static IP
203.0.113.0/24 Subnet (/24) 256 addresses: 203.0.113.0 – 203.0.113.255
10.0.0.0/8 Private range (/8) 16,777,216 addresses — covers all of 10.x.x.x
192.168.1.0/24 Private subnet (/24) 192.168.1.0 – 192.168.1.255 — typical office LAN
172.16.0.0/12 Private range (/12) 172.16.0.0 – 172.31.255.255 — RFC 1918 range
0.0.0.0/0 All IPs Entire IPv4 space — effectively disables the allowlist

IPv6 support

IPv6 addresses and CIDR ranges are also supported. Use standard IPv6 notation, e.g. 2001:db8::/32 or 2001:db8::1 for a single address.

Combining with mTLS

For defense-in-depth, combine IP allowlisting with mutual TLS (mTLS) certificate authentication. This creates two independent verification layers — an attacker would need both a valid certificate and a permitted IP to access your API.

IP Allowlist alone

  • Blocks requests from unknown IPs
  • Does not verify client identity
  • Vulnerable if attacker controls an allowlisted IP
  • Simple to configure, no certificate management

IP Allowlist + mTLS

  • Blocks requests from unknown IPs
  • Verifies client identity via certificate
  • Two independent controls must both be bypassed
  • Recommended for high-security production environments
mtls-with-allowlist.py 
from GlomaxGPT import GlomaxGPT
import httpx

# Configure mTLS client certificate alongside IP allowlist
http_client = httpx.Client(
    cert=("client.crt", "client.key"),   # mTLS certificate
    verify="ca-bundle.crt"               # CA to verify server
)

client = GlomaxGPT(
    api_key="your-api-key",
    http_client=http_client
)

# Requests now require both a valid cert AND an allowlisted IP
response = client.responses.create(
    model="glomaxgpt-ultra",
    input=[{"role": "user", "content": "Hello"}]
)
print(response.output_text)

Troubleshooting

Common issues when setting up or managing an IP allowlist.

I'm getting 403 errors after enabling the allowlist +

Your current IP is likely not on the allowlist. Check your public IP address (e.g. via curl ifconfig.me) and compare it against your allowlist entries. If you're behind a corporate proxy or VPN, the outbound IP seen by GlomaxGPT may differ from your local IP. Add the correct external IP or CIDR range, then re-test.

How do I verify which IP GlomaxGPT sees for my requests? +

Temporarily disable the allowlist and make a test API call. GlomaxGPT includes the source IP in the X-Request-Source-IP header on error responses when an allowlist is active. Alternatively, use a service like https://ifconfig.me or check your network's NAT gateway configuration to identify the external IP used for outbound connections.

My CI/CD pipeline is being blocked +

CI/CD runners (GitHub Actions, GitLab CI, CircleCI, etc.) use dynamic IP ranges that change frequently. Options: (1) allowlist the provider's published IP ranges, (2) route your CI traffic through a static NAT gateway or VPN with a fixed IP, or (3) use a project-level allowlist with a more permissive policy for CI/CD projects while keeping your production project locked down.

Does the allowlist affect the GlomaxGPT Playground? +

Yes, if your organization-level allowlist is enabled and the Playground backend IPs are not listed, Playground API calls will be blocked. The Playground UI may still load (it's a web app), but any model inference calls will return 403. If you need Playground access, either add GlomaxGPT's infrastructure IPs to your allowlist or use a project-level allowlist that doesn't apply to the Playground's project.

Can I set up allowlist changes without downtime? +

Yes. You can add new entries to an active allowlist at any time — additions take effect immediately without blocking existing traffic. To rotate IPs (e.g. when moving servers), add the new IP first, verify requests succeed from the new IP, then remove the old entry. This zero-downtime rotation approach is the recommended practice for production IP changes.

← RBAC Security Overview