Anthropic released IP allowlisting in beta on November 5, 2026, according to its Claude Platform release notes. Organization admins can now list the IP addresses and ranges allowed to reach the Claude Console and covered API endpoints, and requests from anywhere else are refused. Anthropic says the goal is to make a leaked API key much harder for an attacker to use.
Per Anthropic's documentation, a Claude Platform allowlist covers the Console UI and several Claude API endpoints: Messages, Message Batches, Token Counting, Models, Files and Skills. It also covers the Claude Managed Agents endpoints for agents, sessions, environments, vaults and memory stores, as well as the Admin and Compliance APIs. A blocked API call returns a 403 permission_error with the message "Your IP address isn't in this organization's allowed range." Lists accept IPv4 and IPv6 addresses or CIDR ranges, up to 1,000 entries, no broader than /8 for IPv4 or /32 for IPv6. Changes can take up to 15 minutes to apply.
Claude Enterprise organizations get a separate allowlist that owners and primary owners can set. It covers Claude on the web, desktop and mobile, Claude Code when users sign in with a Claude account, Claude in Chrome, the Office add-ins, Cowork and Remote Tools. The documentation says Claude Design, Claude in Slack and Claude Academy are not covered. A task Claude is already running when a user is blocked can continue for up to 24 hours.
There are gaps. The allowlist does not apply to Claude in Amazon Bedrock, Claude Platform on AWS, Claude Models on Google Cloud or Claude in Microsoft Foundry. It also does not govern network traffic from inside the Managed Agents runtime. Anthropic recommends pairing the allowlist with short key expirations or Workload Identity Federation, since an allowlist limits where a key works but not for how long. In the same update, Anthropic added a beta Admin API call that signs a Claude Enterprise member out on every device.
Teams turning this on should list every network that calls the API first, including CI systems, VPNs, proxies and self-hosted sandbox workers. Anthropic also recommends keeping the option that lets admins reach the settings page from any address, so they do not lock themselves out.