IP Whitelisting

Every API key has an IP whitelist: the public IP addresses of the servers allowed to use it.

Production (https://api.yativo.com, and every other host on that server): the key must have at least one allowed IP. A request with no whitelist is rejected with 401.
Sandbox: a whitelist is optional. If you set one, requests must still come from those IPs.

Production keys without a whitelist are refused with 401. Run the check from every production server before you go live.

Find your server’s public IP

Whitelist the public IP your requests leave from. Private addresses such as 10.x.x.x or 192.168.x.x don’t work. Run this on the server that will call the API:

curl https://checkip.amazonaws.com

Setup	What to whitelist
Single server	Its static public IP
Kubernetes, serverless, autoscaling	The NAT gateway or egress IP
Several servers or regions	Each egress IP, or a CIDR range you control
Outbound proxy	The proxy’s public IP
Dynamic IPs (home connections, some hosting platforms)	Not supported. Set up a static egress IP first

Whitelist rules

Production keys need at least one entry, and can have up to 50. Sandbox keys may omit the list.
Each entry is a single IPv4 or IPv6 address (203.0.113.10, 2001:db8::1) or a CIDR range (198.51.100.0/28).
Ranges can’t be broader than /16 for IPv4 or /32 for IPv6. 0.0.0.0/0 is rejected.
IPs added under Profile → Whitelist apply to every API key on your account, on top of each key’s own list.
Setting X-Forwarded-For or similar headers yourself has no effect.

Add or change IPs

On a new key: enter the IPs in Allowed IPs when you generate the key. See API Keys. On an existing key: go to Developers → API Keys and click Edit IPs on the key. The list you save replaces the current one, and the key and secret stay the same. For every key at once: add the IP under Profile → Whitelist.

When moving servers, add the new IP first, deploy, then remove the old one. This avoids downtime.

Check your IP

Call GET /ip-whitelist/check from the server that uses the key. It never blocks, so you can run it any time, including right after changing a whitelist.

curl 'https://api.yativo.com/api/v1/ip-whitelist/check' \
  -H 'X-Api-Key: YOUR_API_KEY' \
  -H 'X-Api-Secret: YOUR_API_SECRET'

{
  "status": "success",
  "status_code": 200,
  "message": "Request successful",
  "data": {
    "key_usage": {
      "authenticated_with_api_key": true,
      "key": "yativo_pk_9f1c2a...",
      "request_ip": "203.0.113.10",
      "allowed_server": true,
      "matched_entry": "203.0.113.10",
      "message": "This API key is being used from an allowed server (203.0.113.10 matches 203.0.113.10)."
    },
    "result": "pass",
    "summary": "203.0.113.10 passes the IP whitelist.",
    "tested_ip": "203.0.113.10",
    "tested_ip_source": "detected"
  }
}

Field	Meaning
`key_usage.allowed_server`	`true` if the server that sent this request can use the key.
`key_usage.request_ip`	The IP Yativo sees for your request. Whitelist this if it isn’t the IP you expected.
`key_usage.message`	The result in one sentence, including the error you’d get if the server isn’t allowed.
`result`	`pass` or `fail` for `tested_ip`.
`network.warning`	Set when your request reached Yativo through a proxy, so `request_ip` may be the proxy’s IP. Contact support if it isn’t your server’s public IP.
`api_key.key_allowed_ips`	The IPs listed on this key.
`api_key.account_whitelisted_ips`	IPs from Profile → Whitelist that also apply to this key.
`api_key.would_return`	The error a request from `tested_ip` would get, or `null` if allowed.

The full response is in the API reference. To check a server you haven’t deployed yet, add ?ip=<address>. result then describes that address, and key_usage still describes the server you called from.

Errors

HTTP	`data.error`	Fix
401	`This API key has no whitelisted IP addresses. ...`	Production request with no whitelist. Add at least one IP to the key. Sandbox allows this.
403	`This IP address is not allowed to use this API key.`	Check your server’s public IP and add it to the key.
403	`IP whitelists and API keys can only be managed from the Yativo dashboard.`	Make the change in the dashboard.

FAQ

Can I allow any IP?

On sandbox, omit the whitelist to call from any IP. On production, every key needs at least one address, and ranges broader than /16 (IPv4) or /32 (IPv6) are rejected.

My key worked and now returns 401 or 403.

A 401 with no whitelisted IPs means you called production without a whitelist. A 403 means your server’s public IP isn’t on the list — run the check endpoint and add the new request_ip.

Get Started

Payments

Wallets

Customers & Compliance

Transactions

Products

Developer Tools

SDKs

Regional Guides

Platform guides

IP Whitelisting

Find your server’s public IP

Whitelist rules

Add or change IPs

Check your IP

Errors

FAQ

​Find your server’s public IP

​Whitelist rules

​Add or change IPs

​Check your IP

​Errors

​FAQ

Find your server’s public IP

Whitelist rules

Add or change IPs

Check your IP

Errors

FAQ