---
title: "Secure your API tokens with an IP allowlist"
description: "An extra layer of security on your API tokens protects your sending at IP level. You decide which servers are allowed to send."
url: "https://lettermint.co/changelog/restrict-your-api-tokens-to-specific-ip-addresses"
published: "2026-07-28"
last_updated: "2026-07-28"
---

# Secure your API tokens with an IP allowlist

> An extra layer of security on your API tokens protects your sending at IP level. You decide which servers are allowed to send.

When you send email, you want to keep access as limited
as possible. That way a token only does what it's meant
to do, in the place where it's meant to run. That's why
you can already create multiple tokens per project, and
use *project limits* to decide which projects may send
from a domain. If you run an
[agency](https://lettermint.co/for/agencies)
with a project per client, one client's domain stays out
of reach of another client's project.

What you couldn't do yet was decide where a token may be
used from. From now on you can give each token a list of
allowed IP addresses. That works for the API and for
[SMTP](https://lettermint.co/knowledge-base/definitions/what-is-smtp).

## How it works

To send an email with Lettermint you connect to our
servers. Every connection comes from an IP address. That
is the address of the machine you send from. Because that
address is part of the connection, you can use it to
secure who gets to use your token.

You set the list per token. That way you can pin the
token on your production server to a single address and
leave the one you use locally open. You can enter a
single address, or a whole range at once.

Connections from any other address are rejected with a
`401`. Leave the field empty and the token works from
any address. In your token overview, `Restriction` shows
which tokens are limited and which are not.

You can restrict your team API tokens the same way. The
same then applies to managing your domains, projects and
webhooks.

## Now available

In your
[dashboard](https://app.lettermint.co)
you'll find your API tokens under your project. Edit an
existing token there to set the list. For team API tokens
you do the same under `Manage team`. Read more in our
documentation on
[project API tokens](https://lettermint.co/docs/platform/projects-and-routes/api-tokens#restrict-a-token-by-ip-address)
and
[team API tokens](https://lettermint.co/docs/platform/teams/api-tokens#restrict-a-token-by-ip-address).