Api access restrict by ip address

[Gopi Ramamoorthy]

Is it possible to restrict Atlassian API Access  by

IP address or any other controls. ?

[Piotr Witka]

hi ! @Gopi Ramamoorthy . Please try following:

1. Disable basic authentication for API calls: https://confluence.atlassian.com/enterprise/disabling-basic-authentication-1044776464.html

2. Setup token authentication with IP restrictions:

You can also use some advanced plugins like Kantega:

[Trudy Claspill]

Hello @Piotr Witka 

Your screen image for My API Token is from a self-hosted (i.e. Data Center) Jira Product.

The author of the post specified Cloud as their Deployment. That is the Atlassian-hosted SaaS products.

Your information does not apply to the Cloud/SaaS product.

[Richard Cho]

If your organisation has a VPN then you can configure the IP allowlist to restrict traffic.

https://support.atlassian.com/security-and-access-policies/docs/specify-ip-addresses-for-product-access/

[Trudy Claspill]

Hello @Richard Cho 

Wouldn't that apply to all access to the UI also? The post author asked about restricting API access.

[Trudy Claspill]

Hello @Gopi Ramamoorthy 

Welcome to the Atlassian community.

Can you tell us about the problem you are trying to solve by implementing this? Perhaps we can suggest how to address the problem in another way.

It is not possible to restrict API access by IP addresses.

[Russell Stadler]

I found this response searching for this feature.  I figure I can describe _a_ use case, even if it's not the same as the original poster here.

We don't use IP allowlisting because we do want users to be able to interact with Jira/Confluence from basically anywhere.

However, when we create a service account for a team building some integration with an Atlassian tool, now there exists this token that _should_ only ever be used originating from our network(s), but we have no way to control for that.  We'd want to be able limit tokens associated with service accounts (i.e., not subject to being rendered useless when the associated person changes roles/leaves the company/etc.) to only have access from networks we manage.