Skip to main content

Set up your Allowed IPs

Allowed IPs are the addresses your servers call Moyasar from. A request made with your secret key from any other address is refused, so a leaked key cannot be used from somewhere else.

Allowed IPs apply to the secret key only. Requests made with the publishable key are not restricted by address.

Where to find it​

  1. Log in to the Moyasar Dashboard.
  2. Open Settings, then the API Keys tab.
  3. Each environment has its own Allowed IPs list under its keys.

You need permission to manage API keys to see this page. Live and test keep separate lists, so adding an address to one does not add it to the other.

EnvironmentWhat applies
LiveYou must list at least one address. Requests from any address that is not on the list are refused.
TestWorks from any IP address until you choose Specific addresses and add your own.
Live key that works from any IP address

Some existing live accounts still accept the live secret key from any IP address. If yours does, the dashboard shows a warning, and the live secret key stays hidden and cannot be rotated until you add your addresses. Once you save a live list, the key works only from those addresses, and live cannot be set back to any IP address.

Add your live addresses first​

Your live secret key stays hidden, and cannot be regenerated, until the live list has at least one address.

Live Keys card with the secret key hidden until allowed IP addresses are added

Add addresses​

  1. Under the environment you want, click Add (or Edit if the list already has addresses).
  2. Type an address and press Enter. Repeat for each address.
  3. Click Save.

Allowed IPs editor with a single address, a CIDR block and a range

You can enter addresses in any of these forms:

FormExampleNotes
Single address203.0.113.10IPv4 or IPv6.
CIDR block198.51.100.0/24The editor shows how many addresses the block covers.
Range203.0.113.20-203.0.113.23IPv4 only. Saved as the CIDR blocks that cover the range exactly.
Pasted list203.0.113.10, 198.51.100.0/24Separate entries with commas, spaces or new lines.

Limits:

  • Up to 100 entries per environment.
  • An IPv4 block can be no wider than /16, and an IPv6 block no wider than /32.
  • Private, loopback and link-local addresses, such as 10.x.x.x, 192.168.x.x or 127.0.0.1, cannot be added. They never reach Moyasar.

A wide range can turn into several entries, because it is stored as CIDR blocks. Each block counts toward the 100 entries.

Confirm the change​

Saving the live list asks for a six-digit code, so that someone who gets into your dashboard session cannot quietly add their own address.

  • If you turned on two-factor authentication, enter the code from your authenticator app.
  • Otherwise, Moyasar emails a code to your account address. It expires after ten minutes, and you can ask for a new one from the same window.

Changes to the test list do not ask for a code.

Once saved, the new list applies to the next request, and the live secret key ID is shown again.

Live Keys card showing the secret key ID and the saved allowed IPs

Where to find your server IP​

Use the public outbound IP of the server that calls the Moyasar API. This is the address Moyasar sees, which is often different from the address your website is served on.

  • Cloud servers: your hosting provider lists it as a static IP, elastic IP or reserved IP.
  • Servers in a private network: requests leave through a NAT gateway, so add the NAT gateway's public IP.
  • Serverless and shared hosting: outbound addresses often change. Set up a static outbound IP with your provider first, then add it.
  • More than one server: add the outbound address of every server, worker and scheduled job that uses the secret key.

To check the address a server uses, run this on the server itself, not on your own computer:

curl https://checkip.amazonaws.com

When a request is refused​

A secret key request from an address that is not on the list is answered with 401 Unauthorized:

{
  "type": "authentication_error",
  "message": "This IP Address is not whitelisted to do this operation",
  "errors": null
}

If you see this from your own server:

  1. Run the command above on that server and compare the result with your list.
  2. Check that you edited the list for the right environment. Live and test are separate.
  3. If your provider changed your outbound address, add the new one and remove the old one.
Last updated on