Skip to main content
HTTP status: 403 · Title: “IP not allowed”

​
When it fires

The key has an IP allowlist configured and the request’s source IP is not on it. An empty allowlist (the default) allows any IP, so this code only fires when an allowlist is configured and the caller’s IP doesn’t match.

​
Why it happens

  • The key is locked to specific egress IPs (common for market-maker and enterprise keys) and the call came from somewhere else: a laptop, a CI runner, or a proxy with a different egress.
  • Your egress IP changed (a cloud NAT gateway was replaced, or a dynamic ISP address rolled over).

​
How to fix

  • Confirm the public IP your requests leave from (for example by calling an IP-echo service from the same host).
  • If the new IP is legitimate, add it to the key’s allowlist in the Kash web app (Settings → API Keys), or contact ZeroID support with the requestId of the refused call.
  • If the IP is not one of yours, the allowlist has just stopped an unauthorised use of your key. Revoke the key and issue a new one.
See Authentication for IP allowlists.