Skip to main content
  • What: Restrict which IP addresses can make REST API requests to your Plivo account.
  • When: Use it to limit API access to your known server IPs — inbound traffic (your servers → Plivo API).
IP Whitelisting adds an extra layer of API access control by allowing requests only from specified IP addresses or CIDR ranges. When enabled, any API request from a non-whitelisted IP is rejected with an HTTP 403 Forbidden response.

​
Key Points

  • Plivo matches the requesting IP address against your whitelist using CIDR matching.
  • Requests from non-whitelisted IPs receive an HTTP 403 Forbidden response.
  • Only “Allow” rules are supported — there are no “deny” or custom logic rules.
  • Maximum of 50 CIDR entries per account.
  • Subaccounts inherit the parent account’s whitelist rules. Subaccount CIDRs cannot be independently managed.
  • Validation checks run when you add new entries and when you edit existing ones to prevent overlaps, supersets, and duplicates.
  • IP Whitelisting takes effect as soon as you add your first CIDR entry.

​
Set Up IP Whitelisting

​
Step 1: Navigate to IP Whitelisting

  1. Log in to the Plivo console.
  2. Go to Account Settings > IP Whitelisting from the left navigation pane.

​
Step 2: Add IPs

  1. Click + Add CIDR Address.
  2. In the modal popup, enter one or more IP addresses in CIDR format (comma-separated).
    • Example: 192.0.2.0/24, 1.1.1.1/32
  3. Click Add to save the entries.

​
Step 3: Confirm Entries

After adding CIDRs, the system blocks any API request not coming from whitelisted IPs. The list shows all currently active CIDRs with subnet masks. You can edit or delete any entry at any time.
Before enabling, make sure you have added the IP addresses of all servers, CI/CD pipelines, and developer machines that make Plivo API calls. Forgetting an IP locks out those systems immediately.

​
Validation Rules

Follow these rules to avoid configuration errors.

​
FAQ

​
What happens if my IP is not whitelisted?

Your API requests are rejected with an HTTP 403 Forbidden response:

​
How many CIDRs can I add?

You can add up to 50 CIDR entries per account.

​
Can I add a single IP without a CIDR mask?

No. You must use CIDR format. For single IPs, use /32 for IPv4 or /128 for IPv6 (e.g., 203.0.113.5/32).

​
Can I whitelist IP ranges?

Yes, use CIDR notation (e.g., 203.0.113.0/24) to specify a range.

​
Can subaccounts have different IP rules?

No. Subaccounts follow the CIDR rules of their parent account.

​
How can I troubleshoot blocked access?

Check that:
  • Your current IP matches one of the whitelisted CIDRs.
  • There are no formatting or range-related issues with your entries.