Skip to main content

Restrict access by IP

Lock your account down to networks you trust — both who can sign in to the admin app and where your most sensitive API calls are allowed to come from.

Paylode gives you two independent IP allow-lists, and it's worth being clear about the difference up front because they protect different things:

  • Auth-level whitelist — controls who can sign in to the admin app. When it's set, sign-in attempts from any address outside the list are refused, before any password is even checked.
  • App-level whitelist — controls where your sensitive API operations are allowed to run from — for example, redeeming a single-use code, or fetching rewards for a Boost campaign that has its IP-whitelist setting switched on. Requests to those operations from an address outside this list are rejected.

They're separate lists with separate effects. Setting one doesn't touch the other. A common setup is to restrict sign-in to your office and VPN networks (auth-level) while allowing your server's egress IPs to run redemption calls (app-level).

Both lists are managed with no code, in the admin app under Admin → Security.

How the lists work​

  • You describe each trusted network in CIDR notation — an address plus a prefix. Accepted prefixes run from /20 (about 4,000 addresses) down to /32 (a single address), so you can allow a whole office range or one fixed server IP.
  • An empty list means no restriction. If a list has no entries, every address is allowed — that's the default. The restriction only takes effect once you add at least one network. (One exception: a Boost campaign with its IP-whitelist setting switched on is fail-closed — see Restrict rewards to trusted networks.)
  • Updating a list replaces it. Saving a list sets the complete set of trusted networks; anything you leave out is no longer trusted. Always include the entries you want to keep.
caution

Adding your first entry can lock you out. The moment a list goes from empty to non-empty, every address not on it is blocked. Before you save an auth-level list, make sure your own current network is included — otherwise your next sign-in will be refused. Add your address first, confirm you can still get in, then tighten.

Set the lists in the app​

In Admin → Security, you'll find the two lists side by side. For each one, add the networks you trust — an IPv4 address plus a CIDR mask between /20 and /32, with an optional note to remind you what each entry is for — then save. Removing an entry and saving stops trusting that network; clearing every entry returns the list to "no restriction."

Troubleshooting​

caution

Locked out of the app after saving an auth-level list. Your current network isn't on it. If a teammate on a trusted network can still sign in, have them add your address; otherwise contact Paylode support to clear the list.

note

A sensitive API call started failing after you edited the app-level list. Remember that saving replaces the whole list — an entry you meant to keep may have been dropped. Read the list back and confirm your server's egress address is still present.

note

Which address does Paylode see? Requests reach Paylode through proxies, so the address that's checked is the client address forwarded on the request, not necessarily the immediate hop. If an allowed network is being rejected, confirm the public egress address it actually presents.