Security

IP allowlist

For additional security, every user must have at least one allowed IP address or CIDR range. A request from any other address is refused with a 401, and with an empty list every request is refused. The range may be 0.0.0.0/0 (meaning no restriction), but we highly recommend a more restrictive range to provide an extra layer of protection.

Edit your own list in the Allowed IP addresses section of the API access page (avatar menu → SSH keys & API access). For a service account, an administrator edits the list on the account's API access tab.

The allowlist applies to both authentication methods:

• For SSH-JWT, a request with a valid signature whose source IP isn't in the allowlist gets a 401.
• For API Token Basic Auth, the same allowlist is enforced, also with a 401.

Egress IP addresses

TPA Stream's outbound traffic, such as webhook posts and file deliveries, comes from the source addresses published at https://app.tpastream.com/ip-addresses.json. If your firewall restricts inbound traffic, allowlist that published list rather than individual addresses, because the addresses can change.