Skip to content
Error codes · Authentication & API keys

RU-1007: API key is restricted to an IP allowlist

The key is valid, but it carries an IP allowlist and this request did not arrive from an address inside it. The response never says which addresses are allowed; that list is visible only in the dashboard.

On the wire

Ships with HTTP status 403, carrying "code": "RU-1007" in the response body alongside the human-readable error message. Existing fields are never replaced by the code: it is additive.

Common causes

  • The caller's outbound IP changed (a new CI runner, a redeployed server, a NAT egress that rotated) and the allowlist was not updated.
  • The request came through a proxy, VPN, or a different cloud region than the one the list was written for.
  • The key's allowlist was set from the dashboard by a colleague and the integration using it was never moved onto an allowed network.
  • Traffic reaches realuptime over IPv6 while the list only names IPv4 ranges, or the reverse.

How to fix it

  1. Find the caller's real public egress address (for example `curl https://api.ipify.org` from the host that makes the requests).
  2. In the dashboard's API & MCP access section, open the key's menu, choose Edit IP allowlist, and add that address or its range in CIDR form (`203.0.113.9`, `203.0.113.0/24`, `2001:db8::/32`). Changes apply on the next request.
  3. Or clear the allowlist entirely to make the key valid from anywhere again, and use a separate restricted key for the fixed-address integration.

Related codes

Still stuck?

Ask support and mention RU-1007: the code pins down the exact refusal path, so you skip the diagnostic back-and-forth.