Claude Console adds organization-wide IP allowlisting: a leaked API key is confined to listed addresses
Synopsis
Anthropic now offers an IP allowlist for organizations in the Claude Console, in beta, and requests to covered services from addresses not on the list are refused, which limits where a leaked API key can be used. Admins can add IPv4 and IPv6 addresses or CIDR ranges, up to 1,000 per organization. Previously an organization could not narrow the entry point for requests by source address in the console; this setting shrinks the usable range after a key leak from any address to the listed ones.
Interpretation
The Claude Console now lets an organization set an IP allowlist, in beta, and requests to covered services from addresses not on the list are refused. The setting targets the usable range after an API key leak: the list confines request origins to addresses the organization recognizes, rather than letting any address holding the key make requests. The capability is offered in beta in the Claude Console, and an organization can add IPv4 and IPv6 addresses or CIDR ranges, up to 1,000 per organization.
Setup means maintaining an address list in the console, and a request's source address is checked against it before reaching a covered service. A list entry can be a single IPv4 or IPv6 address or a CIDR range, so one entry can cover a block of address space. The cap is 1,000 entries per organization, and the IP allowlisting documentation states what is covered and how to set it up.
Perspective
The feature is offered in beta in the Claude Console for organizations that need to restrict requests by source address; each organization can add up to 1,000 IPv4 or IPv6 addresses or CIDR ranges. What is covered and the setup steps are in the IP allowlisting documentation.
The cap is 1,000 entries per organization, so organizations with many addresses must choose among them, and the feature is in beta.