Option to exclude API from IP allow list enforcement
C
Coral Crocodile
Prior to 2.45.0, IP allow list controls didn't apply to the API. As of 2.45.0, they do, requiring customers to whitelist every IP their API integrations (CIPP, Halo, ScalePad, etc.) call from.
Request: add a setting to exclude the API from IP allow list enforcement, so customers can opt back into the pre-2.45.0 behavior if they don't want IP restrictions applied to API traffic.
C
Cameron Granger
Merged in a post:
Allow IP restrictions to stay active for web access, while exempting API/external app/MCP connections from needing a fixed IP
T
Thoughtful Gecko
Allow having the IP access control feature active for signed-in web sessions, while exempting REST API calls, Hudu external apps, and MCP connections from needing to be on the allowlist. Automation and agent tooling (e.g. n8n, Claude, other MCP clients) often run from infrastructure with IPs that change or aren't published/static, so requiring them on a fixed allowlist isn't practical the way it is for a known office network or VPN. Customers who want IP-based lockdown for human web access should still be able to have that, without losing API, external app, or MCP connectivity every time the underlying infrastructure's IP changes.