IP Allowlist

An IP allowlist is a rule that accepts traffic only from a named set of source addresses and rejects everything else. It appears in SaaS in two directions and the two are routinely confused. Inbound, a customer restricts who may call their API or reach their admin panel, and asks your product for the list of addresses your outbound calls will come from. Outbound, your product restricts which addresses may reach a private endpoint or an internal surface. Both are coarse controls: an address is not an identity, and anyone who can source traffic from an allowed address inherits the permission. The awkward part for a modern SaaS is the promise of stable source addresses. Serverless platforms, autoscaled workers and managed queue consumers do not guarantee a fixed egress address; the pool changes as the provider scales, and a customer firewall quietly starts dropping your webhooks. Vendors who need to make the promise route outbound traffic through a small set of dedicated addresses or a proxy tier, publish them, and then treat them as an interface, so changing them is a breaking change that requires notice exactly like changing an API contract. Allowlists also fail in ways that look like an outage but are not. A packet dropped at a customer firewall produces no error on their side and a timeout on yours, so the failure stays invisible until somebody correlates the two. Because of that an allowlist works best as one layer among several rather than as the authentication story: pair it with a signed request or a client certificate, so the address narrows the attack surface while a cryptographic check actually proves who is calling. Publish the addresses somewhere customers can subscribe to changes, and never quietly add a new one.