If your systems that call the Intercom REST API operate from known, fixed IP addresses, the REST API IP Allowlist lets you enforce that only those addresses can authenticate — even if an API key is compromised.
This adds a network-level layer of protection on top of token-based authentication, reducing the risk of unauthorized access from unexpected locations.
How it works
Intercom first validates the request’s access token.
If REST API IP allowlisting is enabled and your list contains entries, Intercom checks the request’s source IP.
If the IP isn’t allowed, the request returns
403 Forbiddenresponse with the message "Your IP address is not on the allowlist for API access"
Set it up
Toggle “Enable REST API IP allowlist.”
Enter IPv4 addresses or CIDR ranges (comma-separated), e.g.:
203.0.113.42
203.0.113.0/24
Click Save at the top of the page
Behavior summary
Feature off → all IPs allowed
Feature on + empty list → all IPs allowed
Feature on + entries → only listed IPs/ranges allowed
IP not on list → 403 Forbidden
Note
IPv4 only; IPv6 isn’t supported yet.
Applies to all REST API authentication methods (OAuth tokens or API keys).
This control is separate from “Workspace access restrictions,” which governs who can log into the Intercom dashboard; both can be used together.
Monitoring
A teammate activity log will be emitted when changes are made to the allowlist allowing you to monitor for changes.
Note: To monitor successful REST API activity, you can consume the api.request.completed webhook topic which is currently in beta. If you are interested in this feature, please reach out to support and request it.
Need more help? Get support from our Community Forum
Find answers and get help from Intercom Support and Community Experts