IP allowlist
Restrict access to a workspace's public database endpoints by source IP, deny-by-default, with optional time-bound entries.
The IP allowlist controls which IP addresses and CIDR ranges may reach a workspace's public database endpoints. It's managed under a workspace's Network page.
Deny by default. Public database endpoints are reachable only from the ranges you add. With no entries, all public access is denied — add your IP to connect.
Entries
Add a bare IP or a CIDR range. Use my IP auto-detects your current address.
Database endpoints are IPv4-only today. If you enter an IPv6 address it
won't match — add your IPv4 address instead (e.g. from curl -4 ifconfig.me).
When auto-detect finds both, your IPv4 address is used.
Time-bound entries
Each entry has a TTL:
- Permanent
- 6 hours
- 1 day
- 1 week
Temporary entries show their remaining time and expire automatically — useful for granting short-lived access without leaving a range open indefinitely.
Managing the allowlist requires the org.databases.update permission. For access
that avoids public endpoints entirely, use
private networking.