Skip to main content

Optional IP allowlist for live credentials

Reeds Engineering
Reeds Engineering
Developer platform

You can now limit your live credentials to the IP addresses of your own servers. It is optional and off by default, so nothing changes for you unless you turn it on. We recommend it.

What changes once it is on​

  • POST /oauth/token with a live client id from an address that isn't on the list returns 400 with { "error": "unauthorized_client" }, and no token is issued.
  • Every /shipping/v1/* call with a live token from an address that isn't on the list returns 403 with the new code IP_NOT_ALLOWED.
  • Test credentials and test tokens are never restricted.

An empty list accepts any address, as before. Set it up in the dashboard under Developers, in Live mode. See Authentication.