> For the complete documentation index, see llms.txt.
Skip to main content

Check out Port for yourself ➜ 

IP address restriction

Enterprise feature

IP address restriction is available on the Enterprise plan.

IP address restriction limits access to your Port organization to specific IP addresses, such as an office network or a VPN. Port blocks sign-ins and API requests from any IP address that isn't on the allow list.

Available through Port support only

You can't edit the IP address restriction lists yourself. Port support adds, changes, and removes the allowed IP addresses for your organization. To request a change, contact support.port.io by chat, Slack, or email.

The allow list applies to:

  • Signing in to the Port UI.
  • API requests to api.port.io (EU) or api.us.port.io (US), whether they come from a user, a script, a CI pipeline, Terraform, or a self-hosted integration.

How the allowed list works​

  • Empty list: all IP addresses are allowed.
  • Not empty: only IP addresses on the list are allowed.

List formats​

The allowed list can contain any mix of these entry types:

FormatExample
Single IP address203.0.113.10 or 2001:db8::10
Range (start-end)203.0.113.1-203.0.113.254 or 2001:db8::1-2001:db8::ff
CIDR notation203.0.113.0/24 or 2001:db8::/32

IPv4 and IPv6 entries are matched separately. An IPv4 entry never matches an IPv6 address, and the reverse is also true. Your users can reach Port over either protocol, so include both your IPv4 and IPv6 ranges.

Write each entry in full. Shorthand IPv4 (such as 10.1), hex or leading-zero IPv4, IPv6 zone IDs, reversed ranges, and ranges that mix IPv4 and IPv6 are rejected.

What users see when they're blocked​

  • Sign-in: the user sees the message "Your IP address is not allowed to access this organization" and is not signed in. If your account has more than one organization, Port signs the user in to their default organization only if that organization allows their IP address. If every organization blocks it, the sign-in is denied. Switching to an organization that blocks the current IP address is also denied, and the user stays in their previous organization.

  • API: the request fails with HTTP 403 and a message like this:

    IP not allowed. IP is not in allow list. IP: <SOURCE_IP>, orgId: <ORG_ID>

Manage the allowed IP addresses​

When you request a change, include the IPv4 and IPv6 entries you want on the allow list.

Add your own address first

Before you turn on IP address restriction, make sure the IP addresses of everyone who needs access are on the allow list. Blocked users can't sign in, and their API requests fail until support updates the list.