# Restrict Access to Management API by IP Address

**URL:** <https://community.auth0.com/t/restrict-access-to-management-api-by-ip-address/75844>\
**Category:** Get Help\
**Created:** [January 5, 2022, 11:37am UTC](https://community.auth0.com/t/restrict-access-to-management-api-by-ip-address/75844 "2022-01-05T11:37:37Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Chr](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/chr/32/12821_2.png) [@Chr](https://community.auth0.com/u/Chr)\
**Post date:** [January 5, 2022, 11:37am UTC](https://community.auth0.com/t/restrict-access-to-management-api-by-ip-address/75844/1 "2022-01-05T11:37:37Z")

</div>

I created a _Machine to Machine_ application that accesses the _Management API_. How do I limit access to it to a few select IP addresses? Do I need to paste the IP addresses into one of the fields in the _Application URIs_ section or do I need to add a rule?

---

<div class="post-metadata">

**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\
**Post date:** [January 5, 2022, 7:38pm UTC](https://community.auth0.com/t/restrict-access-to-management-api-by-ip-address/75844/3 "2022-01-05T19:38:11Z")

</div>

Hi @Chr,

Thanks for reaching out to the Auth0 Community!

A rule will not be sufficient since it only triggers post-authentication.

Instead, I recommend using a [Machine-to-Machine Action](https://auth0.com/docs/actions/triggers/credentials-exchange) to deny issuing tokens to blacklisted IP addresses. See below for a code snippet.

```auto
exports.onExecuteCredentialsExchange = async (event, api) => {
  const blacklist = ["8.8.8.8", "1.2.3.4"]
  if (blacklist.includes(event.request.ip)) {
    api.access.deny('invalid_request', "Access from IP address " + event.request.ip + " is not allowed.");
  }
};

```

Please let me know if you have any further questions.

Thank you.

---

<div class="post-metadata">

**Author:** ![Chr](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/chr/32/12821_2.png) [@Chr](https://community.auth0.com/u/Chr)\
**Post date:** [January 5, 2022, 10:26pm UTC](https://community.auth0.com/t/restrict-access-to-management-api-by-ip-address/75844/4 "2022-01-05T22:26:34Z")

</div>

Thank you for the solution, @rueben.tiow .

I now slightly reformulated your blacklisting to a whitelisting approach.

```auto
exports.onExecuteCredentialsExchange = async (event, api) => {
  const whitelist = ["8.8.8.8", "1.2.3.4"]
  if (!whitelist.includes(event.request.ip)) {
    api.access.deny('invalid_request', "Access from IP address " + event.request.ip + " is not allowed.");
  }
};

```

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [January 20, 2022, 10:27pm UTC](https://community.auth0.com/t/restrict-access-to-management-api-by-ip-address/75844/5 "2022-01-20T22:27:19Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.

---

<div class="post-metadata">

**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\
**Post date:** [March 16, 2022, 6:15pm UTC](https://community.auth0.com/t/restrict-access-to-management-api-by-ip-address/75844/6 "2022-03-16T18:15:26Z")

</div>

Hi @Chr,

After working with one of our Solutions Architects, we revised the Action to ensure that it does not execute for all M2M calls, which could have an indirect consequence when using other APIs.

Given that, the Action script will need to specifically restrict access only to the Management API (`https://YOUR_DOMAIN.REGION.auth0.com/api/v2`).

Here is the new version:

```auto
exports.onExecuteCredentialsExchange = async (event, api) => {
  const whitelist = ["8.8.8.8", "1.2.3.4"]
  if (event.resource_server.identifier = 'YOUR_API_IDENTIFIER' && !whitelist.includes(event.request.ip)) {
    api.access.deny('invalid_request', "Access from IP address " + event.request.ip + " is not allowed.");
  }
};

```

Hoped this helps!

Thank you.