Restrict API access to trusted IP addresses only. Net2APP IP whitelisting provides an additional layer of security beyond API key authentication. Supports IPv4 addresses, CIDR notation ranges, and per-API-key whitelist configuration. Manage whitelist entries from the dashboard or via the REST API.
IPv4
IP Support
Individual IPs & CIDR ranges
403
Auto Reject
Non-whitelisted IPs blocked
Per-Key
Granular Control
Different keys, different IPs
Real-time
Instant Updates
Changes take effect immediately
Simple, effective API access control
From the dashboard, add trusted IP addresses or CIDR ranges (e.g., 203.0.113.0/24) to your whitelist. Multiple IPs can be added per API key.
When an API request arrives, Net2APP extracts the source IP address from the request headers. This is the client's public IP address.
The source IP is checked against all entries in the tenant's IP whitelist. The validation supports exact IP matching and CIDR range matching.
If the source IP matches a whitelist entry, the request proceeds to API key authentication and processing. If not, a 403 Forbidden response is returned immediately.
Enterprise-grade API security for your SMS platform
Whitelist individual IPv4 addresses for precise access control. Each IP address is independently validated on every API request.
Whitelist entire IP ranges using CIDR notation (e.g., 192.168.1.0/24). Useful for organizations with dynamic IP pools or cloud-hosted applications.
Each API key can have its own IP whitelist. Different keys for different applications or environments, each with appropriate IP restrictions.
IP whitelist changes take effect immediately. Add, edit, or remove IP addresses without service interruption or API key rotation.
Full IP whitelist management from the Net2APP dashboard. View all entries, add new ones, and remove old ones with a simple interface.
Programmatically manage IP whitelist entries via REST API. Add, list, and delete IP addresses from your applications or CI/CD pipeline.
Non-whitelisted requests receive a clear 403 Forbidden response with an error message indicating the IP address was not in the whitelist.
Each tenant has an independent IP whitelist. No cross-tenant access possible. PostgreSQL schema isolation ensures complete data separation.
IP whitelisting is a fundamental security best practice for API endpoints. Combined with API key authentication, it provides defense in depth against unauthorized access.
Multi-layer security for your SMS gateway
First line of defense. Only requests from trusted IP addresses are allowed to proceed to authentication. All other requests receive an immediate 403 response.
Second line of defense. Each request must include a valid API key. Keys can be rotated and revoked independently per tenant and per application.
Third line of defense. Configurable rate limits per API key and per tenant prevent abuse and ensure fair resource allocation.
Common questions about IP-based access control
IP whitelisting is optional but strongly recommended for production API integrations. It provides an additional security layer beyond API key authentication. You can enable it per API key from the dashboard and add trusted IP addresses as needed.
If your IP address changes and is no longer in the whitelist, API requests will receive a 403 Forbidden response. To prevent service disruption, you can: (1) Use CIDR ranges to cover a pool of IPs, (2) Keep a fallback API key without IP restriction for emergencies, or (3) Update the whitelist via the API before the IP change.
Yes. IP whitelisting extends to all Net2APP services including the SMPP v3.4 gateway. SMPP bind requests from non-whitelisted IPs are rejected at the network level before any SMPP protocol negotiation begins.
Blocked requests receive a 403 Forbidden HTTP response with a JSON error body indicating the reason. Additionally, failed authentication attempts (including IP whitelist rejections) can be viewed in the dashboard audit log.
Yes. Each API key can have its own independent IP whitelist. This allows granular access control — for example, a production API key restricted to your application servers, a development key restricted to your office IP range, and an emergency key with no IP restriction.
Deploy your secure SMS gateway with IP whitelisting, API key authentication, and rate limiting. No setup fees. Enterprise-grade security for your SMS infrastructure.
Deploy Your Instance Free →