IP Whitelisting

Why Use IP Whitelisting

IP whitelisting adds a second layer of defense on top of request signing:

• Prevent unauthorized access even if your private key is somehow compromised
• Restrict API usage to your infrastructure only — no public access possible
• Reduce attack surface by blocking requests from unknown origins
• Meet compliance requirements that mandate network-level access controls

📘

Applies to both environments

IP whitelisting applies to both the production and sandbox environments. Submit the IPs relevant to each environment you operate in.

When Should You Enable It

Request Flow with Whitelisting Enabled

When IP whitelisting is configured, this is how every request is processed:

1. Request reaches CoinMENA
2. Source IP is checked against your registered whitelist
3. If IP is not whitelisted → request is rejected with 401 Unauthorized
4. If IP is whitelisted → signature validation continues
5. If signature is valid → request is accepted

📘

Connection to Authentication

IP validation and signature validation are independent checks. A valid signature does not bypass IP whitelisting, and a whitelisted IP does not bypass signature validation. Both must pass.

What Gets Validated

CoinMENA checks the source IP of the incoming request against your registered whitelist. This check happens before or alongside signature validation.

• You can register multiple IPs — requests are allowed if any registered IP matches
• There is no priority or ordering between whitelisted IPs — any matching IP is accepted
• There is no limit on the number of IPs you can register
• The IP is taken from the request source before proxies, unless your setup is configured otherwise — if you are using Cloudflare or another proxy, the source IP seen by CoinMENA may differ from your server IP

How to Request Whitelisting

To add or update your whitelisted IP addresses, send an email to [email protected] with:

• Your Partner ID
• The IP address or addresses you want whitelisted
• Whether this is a new addition or a full replacement of existing IPs
• The environment the IPs apply to (production, sandbox, or both)

⚠️

Changing your server IP?

Contact CoinMENA at [email protected] before the change takes effect to avoid service interruption.

How to Find Your Server Public IP

Make sure you submit your server's public IP, not your local machine IP.

curl ifconfig.me

or

curl https://api.ipify.org

Run this from the server that will be making API calls, not from your local machine.

Deployment Considerations

Different infrastructure setups require different approaches:

⚠️

Cloud environments

If you are running on AWS, GCP, or Azure, make sure to use a static or elastic IP address. Default cloud instance IPs can change on restart, which will cause intermittent 401 failures.

What Happens If My IP Is Not Whitelisted

If your IP is not on the whitelist, the API returns:

{
  "code": 401,
  "msg": "Unauthorized"
}

This response is identical to a signature failure (401 Unauthorized), so you must check both signature correctness and IP whitelisting when debugging.

• If your signature logic is correct but you are still getting 401 → check your IP
• If you are on a new server or changed infrastructure → your new IP likely needs to be whitelisted
• If you are getting intermittent 401 errors → your IP may be dynamic

📘

Still stuck?

If you have ruled out IP issues and still receive 401, the cause is likely signature-related. See the Authentication guide's troubleshooting section for a systematic debugging checklist.

Common Issues

📘

Debug Tip

If you are unsure whether a 401 is caused by a signature issue or an IP issue, temporarily disable IP whitelisting (if allowed by your account configuration) to isolate the problem to signature validation only. Re-enable whitelisting once your integration is stable.