IP restrictions

Restrict an app to your office network or company VPN. In addition to checking login and app permissions, Keelson checks the network a user connects from. This is called IP restriction.

It applies to server-side web apps and the API portion of hybrid apps, where page delivery and server-side processing are separate. It does not apply to static sites, SPAs, static files in hybrid apps, or Media delivery URLs. See Scope for details.

Required permissions / plan: Creating access sources, setting workspace defaults, and configuring individual apps all require Owner or Admin. App manage permission alone is not enough. Available on all plans.
Done when: The app opens from an allowed network, and other networks receive an access denied page showing the IP address they are connecting from.

How it works

Configure IP restrictions using access sources: named collections of allowed network addresses. For example, an access source named “London office” can contain several IP addresses or address ranges. Ranges use CIDR notation, such as 203.0.113.0/24.

Create access sources in the workspace.
Choose the workspace’s default allowed sources. An empty selection means no IP restrictions.
For each app, choose whether to inherit the workspace default or use sources selected specifically for that app.

New apps inherit the default. Changing the workspace default updates all apps that inherit it. Apps with their own sources use those settings instead.

Set up restrictions

Create an access source (Owner / Admin)

In the console, open Settings → Security → Allowed Sources and select + Add Source.

Source name: For example, “London office” or “VPN”.
IP / CIDR: One entry per line. Both IPv4 and IPv6 are supported. Enter individual addresses (203.0.113.10) or ranges (203.0.113.0/24). Use Add current IP to include the address you are connecting from.
Add to workspace default: Select this to include the new source in the default as soon as it is created.

To make an existing source part of the default, select it under Default Allowed Sources on the same Security page, then select Save default sources.

Ask your network administrator which fixed IP addresses or ranges to register: “I want this app to be accessible from the office and our company VPN.”

Home and mobile networks may change your IP address, which can prevent access even after you register it.

Configure an individual app (Owner / Admin)

Open the app’s Settings → Security.

Mode	Behavior
Inherit Workspace Default	Applies the default access sources. If the default is empty, there are no IP restrictions
App-specific Sources	Replaces the default with one or more sources selected for this app

For an app without IP restrictions, configure it to inherit an empty default. Clearing the default removes IP restrictions from every app that inherits it. To keep restrictions on other apps, first switch those apps to their own access sources, then clear the default.

Changes take effect without a deployment, normally within two minutes. Changes made during an outage take effect after recovery.

If access is denied

When someone opens an app from a network that is not allowed, they see a page after login explaining that the app is available only from allowed access sources. It also shows their current IP address.

Check whether you need to connect to the company VPN. If the address needs to be added to an access source, send the displayed IP address to an Owner or Admin.

Scope

Restrictions apply to signed-in users accessing container-based web apps and the API portion of hybrid apps.
They do not apply to static sites, SPAs, static files in hybrid apps, or Media delivery URLs (/__keelson/media/<file-id>). Media checks login and app view permission. See Files and Media.
App tokens and webhooks use the allowed IPs configured on each token, rather than the workspace or app settings. See External Integrations.
Tools that AI clients call over MCP are also subject to the same workspace default and per-app settings. The IP address checked is that of the AI client’s server. Calls from claude.ai or ChatGPT come from each provider’s servers, not from the user’s computer, so they are denied as-is for apps with an IP restriction. See Use your app from AI clients (MCP).

Technical details

Checks run in this order: login → app permissions → IP address. IP restrictions add a further requirement to login and app permission checks.

Requests from disallowed networks return HTTP 403. Browser page navigation receives an explanatory page; requests made within a page (fetch / XHR) and API calls receive JSON.