API Keys: Restrict Access by IP Address and Origin

Decide where each API key works. Add access restrictions to any API key, shared or dedicated, and Tatum only accepts its requests from the IP addresses and websites you allow. A key locked to your servers' IP addresses is useless to anyone who copies it.

What you get

• IP allowlists: Allow single IPv4 and IPv6 addresses or whole CIDR ranges, such as 203.0.113.0/24.
• Origin allowlists: Allow your websites by origin, such as https://app.example.com, or every subdomain at once with https://*.example.com.
• Bulk entry and labels: Paste many entries at once, separated by commas, spaces or new lines. Invalid entries are flagged before you save, and each entry can carry a label. Up to 1,000 entries per key.
• Enforced on every request: Restrictions apply to the RPC Gateway and the REST APIs. A blocked request gets 403 Forbidden with a message naming the cause, for example Requests from IP address 203.0.113.7 are not allowed for this API key.
• Nothing changes until you opt in: Every key starts without restrictions.

How matching works

With one list set, a request must match that list. With both lists set, a request must match both: it has to come from an allowed IP address and carry an allowed Origin header. Clear both lists to accept requests from anywhere again.

Use separate keys for servers and browsers. Restrict server-side keys by IP address, the stronger control. Restrict browser keys by origin, so they only work on your websites, and treat them as public anyway.

Using restricted keys with the Dashboard

Access Logs, Error Logs, Notifications, Data Insights and AI Builder call Tatum from your browser with the selected API key. With a restricted key, those pages work only if the key allows your current IP address and the Dashboard's origin, https://dashboard.tatum.io.

When you first restrict a key, the Dashboard shows whether the new lists block it and offers to allow your IP and the Dashboard. If a page is blocked later, click Allow the Dashboard to add the missing entry. For a smoother setup, keep a separate key for the Dashboard and leave your production keys restricted.