Secure your API tokens with an IP allowlist

When you send email, you want to keep access as limited as possible. That way a token only does what it's meant to do, in the place where it's meant to run. That's why you can already create multiple tokens per project, and use project limits to decide which projects may send from a domain. If you run an agency with a project per client, one client's domain stays out of reach of another client's project.

What you couldn't do yet was decide where a token may be used from. From now on you can give each token a list of allowed IP addresses. That works for the API and for SMTP.

How it works

To send an email with Lettermint you connect to our servers. Every connection comes from an IP address. That is the address of the machine you send from. Because that address is part of the connection, you can use it to secure who gets to use your token.

You set the list per token. That way you can pin the token on your production server to a single address and leave the one you use locally open. You can enter a single address, or a whole range at once.

Connections from any other address are rejected with a 401. Leave the field empty and the token works from any address. In your token overview, Restriction shows which tokens are limited and which are not.

You can restrict your team API tokens the same way. The same then applies to managing your domains, projects and webhooks.

Now available

In your dashboard you'll find your API tokens under your project. Edit an existing token there to set the list. For team API tokens you do the same under Manage team. Read more in our documentation on project API tokens and team API tokens.