Enabling an IP allowlist for account logins

In this tutorial, you'll enable an IP allowlist for your Fastly account so that users can only log in to the Fastly control panel from IP addresses you've authorized. You'll set the allowlist, verify it's working, and learn how to disable it if you need to.

By the end, you'll have restricted control panel access to specific IP addresses and know how to reverse the change if your access needs shift.

Before you begin

This tutorial requires the following:

• The superuser role. Other account roles cannot enable IP allowlisting.
• An account owner telephone number on file. During setup, Fastly checks your current IP address against the list you provide to prevent you from locking yourself out. But if your IP addresses change later (for example, because you move offices) and you forget to update your allowlist, you can lock yourself out of your account. Recovery requires that a Customer Success representative contact your account's owner via telephone during Fastly's regular business hours. To protect your account's security, we will not unlock your account based on an email request alone.

Keep in mind that some Fastly features do not honor the IP allowlist by design:

• Some API endpoints are exempt. Endpoints like historical stats and real-time analytics do not enforce customer IP allowlist checks. For endpoints that do enforce them, requests from IP addresses outside the allowlist receive a 403 Forbidden error with an appropriate message. For more information, contact support.
• Surrogate key purging is exempt. Surrogate-Key purging does not enforce customer IP allowlist checks.

Step 1: Enable the IP allowlist

First, define the IP addresses that should be allowed to log in to the Fastly control panel.

1. Log in to the Fastly control panel.

2. Go to Account > Company settings.

3. In the Login IP allowlist field of the Company settings area, replace the default 0.0.0.0/0 value, which allows access from any IP address, with the IP addresses that should have control panel access to your account.

   

   You can include single or multiple IP addresses or IP ranges, separated by commas, in the following formats:

   • a single IPv4 address (for example, 192.168.0.1)
   • an IPv4 CIDR range (for example, 192.168.0.0/24 or 192.168.0.1/32)
   • an IPv4 wildcard range (for example, 192.168.0.*, 192.168.*.1, or 192.168.*.*)

4. Click Update Company.

Step 2: Verify the allowlist is working

After saving the allowlist, confirm your setup is correct before you rely on it.

1. In the Login IP allowlist field, verify the IP addresses you entered appear as you expect.
2. Log out of the Fastly control panel.
3. Log back in from an IP address that's included in your allowlist. You should be able to log in successfully.

If you can log in from an authorized IP address, your allowlist is working. If you can't, review the addresses you entered and check that your current IP is included.

Disabling the IP allowlist

If you need to remove the allowlist and allow control panel access from any IP address, follow these steps.

1. Log in to the Fastly control panel.
2. Go to Account > Company settings.
3. In the Login IP allowlist field of the Company settings area, replace the default 0.0.0.0/0 value, which allows access from any IP address, with the IP addresses that should have control panel access to your account.
4. Click Update Company.

What's next

You've restricted control panel access to specific IP addresses and know how to reverse the change. From here, you can:

• update the allowlist as your authorized IP addresses change (for example, if your team moves offices or adds a new location).
• review other administrative controls for your company account.

Related content

• Customer API documentation