Claude adds IP allowlist beta for API keys and Enterprise apps, up to 1,000 ranges

3 hours ago

9 min read

Anthropic has added an IP allowlist to the Claude Console and to Claude Enterprise organizations, in beta, according to the Claude Platform release notes dated November 5, 2026. Once an admin or owner switches it on, Anthropic compares the public IP address of every covered request with a list of approved addresses and ranges, and refuses anything that comes from outside it. The list accepts IPv4 and IPv6 entries and holds up to 1,000 entries per organization.

The stated purpose is containment of leaked credentials. Anthropic's documentation says that with an allowlist in place, an attacker who obtains an organization's API key finds it much harder to use, because the key only works from the networks the organization has declared. The same release adds a second administrative control for Claude Enterprise: a beta Admin API endpoint, `POST /v1/organizations/users/{user_id}/sign_out`, that ends a member's sign-in sessions, trusted devices and organization OAuth tokens on every browser and device in a single call.

Both features sit on the administrative side of Claude rather than in the chat interface, and both are in beta. The allowlist is offered under the customer's existing agreement with Anthropic, such as the Commercial Terms of Service, and the documentation warns that settings and behavior can change while the beta lasts. Anthropic has not published a separate price or a plan surcharge for either feature.

··········

HOW THE CLAUDE IP ALLOWLIST CHECKS REQUESTS AND WHAT BLOCKED USERS SEE.

The allowlist applies to the whole organization. An organization admin or owner on the Claude Platform side, or an owner or primary owner on the Claude Enterprise side, enters the approved addresses in settings, and from then on each covered request is matched against that list by its public source address. There is no per-key or per-workspace list described in the documentation, so the same set of ranges governs every API key and every user of the organization.

A rejected API call does not fail silently. The Messages API answers with a 403 `permission_error` and the message "Your IP address isn't in this organization's allowed range." Claude Code returns the same 403 error when a user signed in with a Claude account is outside the list. People who open Claude in a browser or in the desktop app from a disallowed network see a page titled "Your current network can't access this organization." The block also applies to admins and owners, unless the organization keeps the optional escape hatch for the settings page that is described further down.

Anthropic is explicit about the limits of the control. The documentation states that an allowlist restricts where a key works but not how long it works, and recommends combining it with short key expirations or a move to Workload Identity Federation, which removes static keys altogether. In the company's own wording, that combination is safer than allowlisting alone.

··········

WHICH CLAUDE SERVICES THE IP ALLOWLIST COVERS AND WHICH IT LEAVES OUT.

Coverage differs between the two kinds of organization. For Claude Platform organizations, the allowlist restricts access to the Claude Console interface and to the main API surfaces called with an API key or a Workload Identity Federation token. For Claude Enterprise organizations, it extends to the apps employees use every day, including Claude Code when users sign in with their Claude account.

........

Organization type	Covered by the allowlist	Not covered
Claude Platform (Console)	Console UI; Messages, Message Batches, Token Counting, Models, Files, Skills	Claude in Amazon Bedrock, Claude Platform on AWS
Claude Platform (Console)	Managed Agents endpoints: Agents, Sessions, Environments, Vaults, Memory stores	Networking inside the Managed Agents runtime
Claude Platform (Console)	Admin API and Compliance API with an organization-only key	Claude Models on Google Cloud, Claude in Microsoft Foundry
Claude Enterprise	Claude on web, desktop and mobile; Claude Code with Claude sign-in	Claude Design, Claude in Slack, Claude Academy
Claude Enterprise	Claude in Chrome, Office add-ins, Cowork, Remote Tools	Artifacts a user shared outside the organization
Claude Enterprise	Connectors and artifacts in covered apps; Admin and Compliance APIs	Tasks already running, for up to 24 hours

........

Two of these exclusions deserve attention from security teams. The allowlist covers requests to the Managed Agents endpoints, but it does not govern any network traffic generated inside the Managed Agents runtime, so an agent's own outbound calls are outside its scope. On the Enterprise side, a task Claude is already working on in a chat can keep running for up to 24 hours after the user is blocked, although that user cannot open or control the chat from an unlisted network.

Customers who reach Claude through cloud marketplaces also need a separate plan. The documentation says the allowlist does not apply to Claude in Amazon Bedrock, Claude Platform on AWS, Claude Models on Google Cloud or Claude in Microsoft Foundry, which means network restrictions for those routes still have to be enforced with each cloud provider's own tools.

··········

HOW TO TURN ON THE CLAUDE IP ALLOWLIST WITHOUT LOCKING OUT YOUR TEAM.

The setting lives on the Identity and access page of the Claude Console for Platform organizations, and under Organization settings, then Organization and access, in claude.ai for Enterprise organizations. The procedure Anthropic documents has three stages. An admin first turns on the IP allowlist toggle, which changes nothing until the page is saved. The admin then adds entries with Add entry in the Console or Add IP range in claude.ai, typing one or more addresses or ranges separated by commas, and saves after confirming. The third stage is monitoring: changes can take up to 15 minutes to apply, and the documentation asks admins to watch for 403 `permission_error` responses, including from jobs that run only once a day or once a week.

The format rules are strict, and they determine how tight the list can be.

........

Allowlist rule	Value in the beta
Address families	IPv4 and IPv6
Entry types	Single address or CIDR range
Broadest IPv4 range	/8
Broadest IPv6 range	/32
Maximum entries	1,000 per organization
Private ranges such as 10.0.0.0/8	Not to be used; public egress addresses only
Time for changes to apply	Up to 15 minutes

........

The public-address rule has a security consequence that Anthropic spells out. Because the check uses the address traffic leaves from, a shared proxy address on the list can let an attacker holding a leaked key or a stolen sign-in pass through that proxy. Organizations that route traffic through a corporate proxy also have to check one specific host: Claude in Chrome, Cowork, Remote Tools and the work-across-apps feature of the Office add-ins connect through `bridge.claudeusercontent.com`, and if the proxy sends that host out through a different address than `claude.ai` and `api.anthropic.com`, that address must be listed too.

Lockout prevention is the part of the setup that needs the most care. When an admin saves, the page checks only that admin's current address. It does not test servers, CI runners, teammates, or addresses that will change later. Anthropic recommends listing every data center, CI system, office, VPN, proxy and worker for self-hosted sandboxes before saving, and selecting the option "Allow admins to access this settings page from any IP address" in the Console, or the equivalent owner option in claude.ai. The trade-off is acknowledged in the documentation: with that box selected, an attacker who compromises an admin's or owner's session could change the list remotely. Changes to the allowlist are recorded in the Compliance API's Activity Feed, which gives auditors a trail of who edited it.

Admins who do lock themselves out have four documented routes back: reconnect from a listed network and click Try again, ask another admin on a listed network to add the address, use the Open IP allowlist link and the Add it button if the escape-hatch option was selected, or ask Anthropic support to turn the allowlist off. Remote employees are the most likely to be cut off, since phones on mobile data, home Wi-Fi and laptops off the VPN are blocked until they connect through a listed network. Users blocked from the organization can still sign in to other organizations or to a personal account.

··········

[[ADPLUS_300x250_1]]

SIGNING A CLAUDE ENTERPRISE MEMBER OUT EVERYWHERE WITH THE ADMIN API.

The second November 5 change targets offboarding and incident response in Claude Enterprise. The new beta endpoint signs one member out of Claude everywhere and requires an Admin API key with the `write:members` scope; looking the member up by email first also needs `read:members`. Every request must carry the `admin-user-sign-out-2026-10-08` beta header. The documentation gives this request, which takes no body and uses the member's `id` from the List members endpoint:

curl -X POST "https://api.anthropic.com/v1/organizations/users/user_01AbCdEfGhIjKlMnOpQrSt/sign_out" \
  -H "x-api-key: $ANTHROPIC_API_KEY" \
  -H "anthropic-version: 2023-06-01" \
  -H "anthropic-beta: admin-user-sign-out-2026-10-08"

A successful call returns the member's user object with role and other fields unchanged. The member stays in the organization and can sign in again immediately, so the endpoint is a session reset, and keeping someone out still requires removing them or disabling the account in the identity provider. Anthropic lists precisely what the call ends and what it leaves alone.

........

Ended by sign-out everywhere	Left running or valid
Sign-in sessions on every browser and device	API keys, including Admin API keys the member created
Trusted devices registered for sensitive actions	OAuth tokens for the member's other organizations
OAuth tokens issued for this organization, e.g. Claude Code	Account-level OAuth tokens not tied to an organization
Records of browsers that skipped two-step verification	Claude Code cloud sessions and scheduled or GitHub-triggered routines
Push-notification registrations, usually within a minute	Computers linked to Cowork

........

Several operating details matter for anyone scripting it. The primary owner cannot be signed out, and the request then returns a 400 error with `cannot_sign_out_primary_owner`. A `write:members` key only works in the organization where it was created, so companies with several linked organizations need one key and one request per organization. The endpoint shares the Admin API limit of 100 requests per minute, retries are safe because a 200 comes back even when nothing is left to end, and sign-ins already in progress can still complete during the request or up to five minutes after it. Each completed sign-out appears as `org_user_trusted_devices_revoked` in the audit log export and, when the Compliance API is enabled, in the Activity Feed.

··········

WHAT CHANGES FOR CLAUDE API TEAMS AND CLAUDE ENTERPRISE ADMINS.

For developers on the Claude API, the allowlist turns a leaked key from an immediately usable credential into one that only works from the organization's own egress addresses. The practical work before enabling it is an inventory: production servers, staging, CI pipelines, scheduled batch jobs, notebook environments and any self-hosted sandbox workers all need their public IPv4 and IPv6 egress addresses on the list, or their calls will start failing with 403 errors within about 15 minutes of saving. Teams that call Claude through Amazon Bedrock, Google Cloud or Microsoft Foundry gain nothing from this setting for those routes. Our overview of Claude API endpoints, structured outputs and enterprise authentication covers the authentication options that sit alongside it.

For Claude Enterprise owners, the allowlist reaches further than the API, since it also gates the web, desktop and mobile apps, Claude Code with Claude sign-in, Claude in Chrome, Cowork and the Office add-ins. Companies with remote staff will have to decide whether to require a VPN for Claude access, because home and mobile networks are blocked by design. The sign-out endpoint fits into offboarding scripts and into the response to a stolen laptop, with the documented caveats that API keys, cloud Claude Code sessions, routines and Cowork-linked computers need separate handling. Admins already rolling out connectors may also want to review how Claude plugins auto-connect for Team and Enterprise organizations, since connectors in covered apps fall under the allowlist as well. Earlier Console changes, such as the 128 MB request limit and the Usage and Cost Analytics API beta, sit in the same release-notes stream.

··········

CLAUDE IP ALLOWLIST AND ENTERPRISE SIGN-OUT: CONFIRMED FACTS AND OPEN QUESTIONS.

The documented facts are specific. The IP allowlist is in beta for Claude Platform and Claude Enterprise organizations from November 5, 2026, accepts up to 1,000 public IPv4 or IPv6 entries no broader than /8 or /32, rejects covered API calls with a 403 `permission_error`, takes up to 15 minutes to apply, and does not cover Bedrock, Claude Platform on AWS, Claude Models on Google Cloud, Microsoft Foundry, Claude Design, Claude in Slack or Claude Academy. The sign-out endpoint is a Claude Enterprise beta that needs a `write:members` key and a beta header, ends sessions, trusted devices and organization OAuth tokens, and leaves API keys and running cloud sessions untouched.

Several points remain open. Anthropic has not said when either feature will leave beta or whether the allowlist will reach the cloud-marketplace routes, and the documentation does not describe per-workspace or per-key lists, which larger organizations with separate production and research networks may want. The 24-hour grace period for tasks already running in a blocked user's chat is also a design choice that security teams will have to weigh against their own incident-response timelines. For now, the allowlist gives Claude administrators a network boundary they previously had to build outside Anthropic's platform, and its effectiveness depends on how completely each organization maps its own egress addresses before pressing Save.

··········

·····

DATA STUDIOS

·····

datastudios.org