Claude Platform adds an IP allowlist for organizations, so a leaked API key only works from listed addresses

Organizations on Claude Platform can now configure an IP allowlist in the Claude Console, and requests from addresses outside the list are refused, narrowing where a leaked API key can be used to the listed addresses. The entry describes the allowlist as an organization-level setting: whether a request is allowed depends on whether its source address is on the organization's own list, not on the key itself. The capability is offered in beta, entries accept IPv4 and IPv6 addresses or CIDR ranges up to 1,000 per organization, and the platform's IP allowlisting documentation states which services are covered.

Setup means maintaining an organization-level address list in the Console, which the platform uses to decide whether a request's source is allowed. Entries are registered as addresses or CIDR ranges rather than per key, so the constraint applies to the whole organization. The cap is 1,000 entries per organization, and both IPv4 and IPv6 address forms are accepted.

The entry describes a beta, organization-level feature in the Claude Console that governs the source of requests to covered services; the exact coverage and setup steps are given in the platform's IP allowlisting documentation.

The capability is labeled beta, and the release note does not list which services fall under coverage, leaving that to the IP allowlisting documentation.