> ## Documentation Index
> Fetch the complete documentation index at: https://docs.alpic.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# IP Whitelisting

> Restrict access to your MCP server by IP address or MCP client

IP whitelisting lets you control which IP addresses can reach your MCP server. When enabled, only requests from approved IPs or MCP clients are allowed — all others receive a `403 Forbidden` response.

This is useful when you want to limit access to known clients, such as ChatGPT or Claude, or restrict usage to your corporate network.

<Warning>
  IP whitelisting is configured **per environment**. Make sure you configure it for the right environment (e.g.,
  production, staging).
</Warning>

## Platform Selection

For common platforms, Alpic maintains up-to-date IP lists so you don't have to manage them manually. Simply select the platforms you want to allow.

### Conversational platforms

Select the MCP clients whose users reach your server directly:

| Platform    | IP Source                                                                                                                            |
| ----------- | ------------------------------------------------------------------------------------------------------------------------------------ |
| **ChatGPT** | Fetched automatically from [OpenAI's published IP list](https://openai.com/chatgpt-connectors.json), refreshed every 15 minutes      |
| **Claude**  | Based on [Anthropic's published IP addresses](https://platform.claude.com/docs/en/api/ip-addresses), updated with each Alpic release |

ChatGPT IPs are fetched dynamically and remain up to date automatically. Claude IPs are updated with Alpic releases, so if Anthropic changes their egress IP ranges, there may be a short delay before the changes are reflected.

### WAF / CDN platforms

If your MCP server is fronted by a WAF or CDN, trust that provider's egress IP ranges so requests forwarded through it aren't blocked:

| Platform       | IP Source                                                                                                                   |
| -------------- | --------------------------------------------------------------------------------------------------------------------------- |
| **Akamai**     | Fetched from [Akamai's published edge CIDR lists](https://techdocs.akamai.com/origin-ip-acl/docs/update-your-origin-server) |
| **Cloudflare** | Fetched from [Cloudflare's IP ranges API](https://api.cloudflare.com/client/v4/ips)                                         |
| **Fastly**     | Fetched from [Fastly's public IP list](https://api.fastly.com/public-ip-list)                                               |

## Custom IPs

You can also add up to **20 custom IP addresses or CIDR ranges** per environment. Supported formats:

* IPv4 addresses (e.g., `203.0.113.10`)
* IPv6 addresses (e.g., `2001:db8::1`)
* IPv4 CIDR ranges (e.g., `203.0.113.0/24`)
* IPv6 CIDR ranges (e.g., `2001:db8::/32`)

Custom IPs and platform selections work together — a request is allowed if it matches **either** list.

## Setup

<Steps>
  <Step title="Navigate to Distribution">
    In your Alpic dashboard, open your project and go to the **Distribution** tab, then select the **Trusted IPs** section.
  </Step>

  <Step title="Enable IP whitelisting">Toggle the IP whitelist switch to enable the feature.</Step>

  <Step title="Select MCP clients and/or add custom IPs">
    Check the platforms you want to allow — conversational clients (ChatGPT, Claude) and/or WAF/CDN providers (Akamai,
    Cloudflare, Fastly) — and optionally add custom IP addresses or CIDR ranges.
  </Step>

  <Step title="Save">
    Click **Save** to apply the changes. The restrictions take effect immediately for new requests.
  </Step>
</Steps>

<Info>
  IPv4-mapped IPv6 addresses (e.g., `::ffff:192.168.1.1`) are automatically normalized, so you only need to add the IPv4
  form.
</Info>