Rules and limits
IP and country limits
Accept requests only from your servers' addresses, or from the countries you choose.
If your app runs on servers with fixed addresses, list them in allowedIps. A ghost key that leaks is then useless anywhere else. Use single addresses such as 203.0.113.7 or ranges such as 203.0.113.0/24 and 2001:db8::/48.
allowedCountries refuses requests from outside the countries you list. The country comes from the caller's IP address, so treat it as a strong hint, not proof: VPNs exist. For servers, an address list is the stronger choice.
Every request in Activity shows its IP address, country and client. When a key already has an address list, open a blocked request and choose Allow this address to add it. Allowing more addresses is a looser rule, so it waits an hour like any other.
Still have a question?
We read every email, usually within a day.