How can I restrict an API key to specific IP addresses?

Last updated: September 11, 2026

To add an extra layer of security, you can optionally restrict any API key so it only works when a request comes from a pre-approved IP address. This is entirely opt-in — existing keys, and any new key you create without setting an allowlist, keep working exactly as before with no IP restriction.

Setting an IP allowlist on a new API key

Log in to the Rhino.fi Console.
Make sure you have a project set up.
Go to the Integrate section and open the API Keys tab.
Click New API Key, and when prompted, optionally add up to 5 IP addresses the key should be restricted to. Leave this blank if you don't want any restriction.

Editing the IP allowlist on an existing key

In the API Keys tab, open the key you want to change.
Add, remove, or replace the IP addresses on the allowlist — you can set anywhere from 0 to 5 IPs.
Save your changes. The key's restriction takes effect immediately.

What happens if a request comes from an IP that isn't on the list?

The request is rejected with a descriptive error, so it's clear the failure is due to the IP allowlist rather than a general authentication issue.

Good to know

A key can have a maximum of 5 IP addresses on its allowlist.
Setting or changing the allowlist doesn't affect the key's name, project, or type — those still need to be set separately.
The API Keys table shows whether a key currently has IP restrictions enabled, along with when it was last updated and by whom.