Skip to main content
PUT
Restrict this key to your own addresses
Binds the key to the addresses your servers actually call from. Requests from anywhere else are refused with 403 ip_not_allowed. An empty array clears the restriction. This is the cheapest protection against the most common way keys leak: a log line, a screenshot, a committed .env.
A list that does not include the address you are calling from is refused, not applied — setting an allowlist you are not inside is indistinguishable from revoking your own key. The error echoes the address we saw. To hand a key to servers you are not on, include your own address, apply, then remove it once they are connecting.
The same setting is available in the account panel at csboard.com/profile?tab=api. Neither is the only way in. Authentication required. Send your key as Authorization: Bearer csb_pub_....

Authorizations

Authorization
string
header
required

Send your key as a Bearer token on every request: Authorization: Bearer csb_pub_.... Generate keys in your CSBoard profile.

Body

application/json
ips
string[]
required

Addresses or CIDR ranges. Empty clears the restriction. Max 20.

Response

Applied.

data
object