API Token Security & Access Control
This feature allows you to control how your API token can be used. It helps prevent unauthorized access and ensures that only trusted sources can access your API.
You can restrict API access based on:
Domain (for front end/browser usage)
IP Address (for back end/server usage)
Both (for flexible and secure access) Before configuring restrictions, decide: - Is this API token being used from the front end (browser) or the back end (server)?
Front end Access (Domain Restriction):
Use this option when your API is called from:
- Web applications
- Browser-based apps
- JavaScript front end projects
You can add up to 5 allowed domains. Example: example.com
How It Works
If the request domain matches one of the allowed domains → Access Granted
If the domain does not match → Access Denied
If only Domain Whitelist is enabled → Back end requests will NOT work.
Back end Access (IP Restriction)
Use this option when your API is called from:
Back end servers
Server-to-server integrations
cURL scripts
You can add up to 5 allowed IP addresses.
Example: 192.168.1.1
Notes:
Only static IP addresses are supported.
Dynamic IP addresses are not recommended and may cause access issues.
Do not use internal or network IPs. Use your server’s public static IP address.
If IP restriction is enabled but no IP address is added → All backend requests will be blocked.
How It Works
If the request IP matches one of the allowed IPs → Access Granted
If it does not match → Access Denied
If only IP Whitelist is enabled → Front end requests should NOT work.
Using Both Domain and IP Whitelist
If both restrictions are enabled:
Front end requests must match one of the allowed domains.
Back end requests must match one of the allowed IP addresses.
Each request is validated based on its source (browser or server).
Access Denied Response
If access validation fails, the API returns:
{
"error": "Access denied. You don't have permission to access this."
}
HTTP Status Code: 403 Forbidden
Last updated