Claude Console adds an organization-wide IP allowlist, narrowing where a leaked API key can be used

Organization admins can now set an IP allowlist for the whole organization in the Claude Console, and requests from addresses not on the list are refused, narrowing where a leaked API key can be used to the listed addresses. Previously organizations had no console-level source-address restriction, so a leaked key's usable range was not bounded by an organization address list. The feature ships in beta, and its coverage and setup are documented on the IP allowlisting page, with up to 1,000 IPv4 or IPv6 addresses or CIDR ranges per organization.

The allowlist is configured per organization, and entries can be single IPv4 or IPv6 addresses or CIDR ranges that admins maintain in the Claude Console. Entries are expressed at two granularities, an address and a range, so a list can pin one egress address or cover a block of address space. The release notes give a cap of 1,000 entries per organization and point to the IP allowlisting page for what is covered and how to set it up.

The feature targets organizations in the Claude Console, is offered in beta, and covers only the services listed on the IP allowlisting page; each organization can hold up to 1,000 IPv4 or IPv6 addresses or CIDR ranges.

The release notes label the feature beta and point to the IP allowlisting page for what is covered and how to set it up, so the exact coverage list depends on that page.