IP allowlist

Settings → IP Allowlist (/gravity/settings/ip-allowlist) lets an organization Owner or Admin restrict Sencai access to a set of trusted IP ranges.

How it works

Add one or more CIDR ranges (IPv4 or IPv6, for example 203.0.113.0/24 or 2001:db8::/32). Once at least one range is configured, your organization is enforced: anyone signed in who is a member of your organization is only able to reach the platform’s API from an IP address inside one of those ranges. Remove every range to go back to unrestricted access - an empty list means no restriction at all, which is the default for every organization.

Changes take effect as soon as you save them.

A single range is enough to enable enforcement - you don’t need to build an exhaustive list before it takes effect. Common ranges to add:

• Your office’s public IP (a single address is a valid CIDR, written as 203.0.113.42/32)
• Your corporate VPN’s exit range, if your team connects through one
• A CI/CD runner’s outbound range, if pipelines call Sencai’s API

Any range in the list is enough to allow a match - you don’t need every range to include every user, just at least one range that covers wherever each of your members actually connects from.

What it applies to

The allowlist is checked against every organization you’re an accepted member of, not just the one you currently have active in the organization switcher. If you belong to both a locked-down organization and an unrestricted one, being outside the locked-down organization’s allowed ranges blocks you, even while working in the other organization.

It restricts access to the platform’s API - the requests the app makes on your behalf once you’re signed in. It does not gate the sign-in step itself.

Note

The allowlist fails open, not closed, if Sencai can’t evaluate it for some reason (for example, a transient lookup problem) - a system hiccup on Sencai’s side is not meant to be able to lock every one of your organization’s members out at once. The only way you get blocked is a genuine “your IP isn’t in the allowed range” match.

Locking yourself out - and how to recover

Turning this on restricts every member of your organization, including you, to the ranges you list. Before saving:

• Double-check your own current IP address (or your office/VPN’s outbound range) is included.
• If you work from more than one location or a dynamic IP, either include a range wide enough to cover it or make sure a VPN with a stable exit IP is part of your range.

Caution

If you save an allowlist that excludes your own current network, you will be locked out immediately, the same as any other member. If that happens, contact Sencai support - recovering from a self-inflicted lockout requires someone outside your organization’s own restricted access to help, since by definition none of your organization’s members can reach the platform to fix it themselves.

What’s next

• Roles - only Owner and Admin can manage the allowlist
• Access management - the rest of Sencai’s access controls
• Support - if you need help recovering from a lockout