> ## Documentation Index
> Fetch the complete documentation index at: /docs/llms.txt
> Use this file to discover all available pages before exploring further.

# IP Whitelisting

> Restrict bluSwap API access to specific server IPs so leaked x-api-keys cannot be used from unauthorized machines.

IP whitelisting restricts bluSwap API access to a defined list of server IP addresses. Even a valid `x-api-key` will be rejected if the request originates from an IP that is not on your whitelist.

## Why enable IP whitelisting

IP whitelisting adds a second layer of defense on top of your `x-api-key`. If a key is ever leaked, attackers still cannot use it from their own servers.

> [!NOTE]
>
> IP whitelisting protects your `x-api-key` from misuse. It does **not** protect your Client ID and Client Secret. Keep those secured independently.

## Register your server IPs

Add your production server IPs from the merchant dashboard:

**1. Sign in to the dashboard**

Go to your bluSwap merchant dashboard and log in.

**2. Open Settings**

Navigate to **Settings → IP & Secret key → IP Whitelisting**.

**3. Add allowed IPs**

Enter each server's public IPv4 address. Use one address per entry; CIDR ranges are not supported.

**4. Save and test**

Save your changes and issue a test API call from each server to confirm it succeeds.

## Best practices

* Whitelist only the servers that make outbound bluSwap API calls, not developer machines.
* Route API traffic through a fixed egress IP (such as a NAT gateway) when running in cloud environments with dynamic instance IPs.
* Review the whitelist regularly and remove IPs for decommissioned servers.

## Errors

If a request comes from an IP that is not whitelisted, the API returns:

```json theme={"dark"}
{    status="Failure",
                        status_code=401,
                        message="Unauthorized",
                        detail="IP address not whitelisted",
                        data=None,
                    )
}
```

Response status: `401 Unauthorized`. Verify the calling server's public IP and confirm it is registered in the dashboard.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.