Wirestack
Claude API adds IP allowlisting in beta (November 5, 2026)
Admins can now limit Claude API and Console access to listed IP ranges, so a leaked API key is much harder to use elsewhere.
Your keys
0 of 1 ready
Create each key on its own page, paste it below, then copy the finished lines into your project's .env file. What you paste stays in this tab. It is never sent to Wirestack or saved.
- Anthropic API keyANTHROPIC_API_KEYGet key
Click Create key. It starts with sk-ant- and is shown only once
What you get
An organization admin or owner can set a list of IP addresses and ranges for the whole organization. Requests to covered services from any other address are refused. A leaked API key then only works from your own networks.
It covers the Claude Console, the Messages, Message Batches, Token Counting, Models, Files and Skills endpoints, the Claude Managed Agents endpoints, and the Admin and Compliance APIs. It is in beta.
Claude Enterprise organizations have their own allowlist, set by owners and primary owners in claude.ai under Organization settings > Organization and access. It covers Claude on the web, desktop and mobile, Claude Code when users sign in with their Claude account, Claude in Chrome, the Office add-ins, Cowork and Remote Tools, and the Admin and Compliance APIs. The steps below are for Claude Console organizations.
A blocked API request gets a 403 permission_error with the message Your IP address isn't in this organization's allowed range.
Prerequisites
- Admin or owner role in your Claude Console organization.
- The public IPv4 and IPv6 addresses your servers, CI, offices and VPNs send traffic from.
- Your apps already call the API with an Anthropic API key in
ANTHROPIC_API_KEY.
Steps
There is no code for this. It is set up in the Console.
- Open the Identity and access page in the Claude Console: https://platform.claude.com/settings/identity
- Turn on the IP allowlist toggle. Nothing changes until you save.
- Click Add entry. Enter one or more addresses or CIDR ranges, separated by commas, and press Enter. Include the network you are on now.
- Keep Allow admins to access this settings page from any IP address selected, so you can fix the list if you lock yourself out.
- Click Save and confirm.
Entry rules: single addresses like 203.0.113.5 or ranges like 203.0.113.0/24 and 2001:db8::/32. No range broader than for IPv4 or for IPv6. Up to 1,000 entries. Public addresses only, not private ranges like .