Security
IP Allowlisting
Restrict who can reach an app’s public URL with App Shield, the web application firewall on that app. Open it from the app Add-ons tab or the App Shield node on the canvas.
Organization Settings / Security (/security) is an audit trail — it is not an IP allowlist. Allowlisting does not gate the dashboard or the REST API.
Per app, not the control plane
App Shield inspects traffic to that app’s *.stackblaze.app hostname (and any custom domain you attached). It does not block dashboard.stackblaze.cloud (or the app.stackblaze.cloud alias), api.stackblaze.cloud, or mcp.stackblaze.cloud.
App Shield access lists
Allowlist
Empty = all IPs permitted
203.0.113.0/24
198.51.100.42/32
Denylist
Always blocked
192.0.2.0/24
What is affected
Restricted by App Shield
- Public HTTP(S) to this app’s platform hostname
- Public HTTP(S) to custom domains on this app
- WebSocket upgrades to this app (same public path)
Not an IP allowlist
- Dashboard — dashboard.stackblaze.cloud (app.stackblaze.cloud alias)
- REST API — api.stackblaze.cloud/api
- MCP — mcp.stackblaze.cloud
- Org Settings / Security audit trail
Modes and extra filters
App Shield can run in Detection only (log, do not block) or Blocking (403 when a rule or access list denies the request). Sensitivity presets tune how aggressively OWASP rules score traffic. Geographic filtering and rate limits live on the same Protection tab if you need them.
Step by step
Add App Shield to the app
Open the app’s Add-ons tab, or the App Shield node on the canvas. Enable App Shield for that app. It is per app, not project-wide.
Open Protection → access lists
On the Protection tab, expand the access section. Allowlist and Denylist accept IPv4 or IPv6 CIDR ranges (for example 203.0.113.0/24 or a single host as /32).
Add allowed ranges
On Allowlist, enter a CIDR and click Add. An empty allowlist means all IPs are permitted (denylist and WAF rules still apply). Once you add entries, only those ranges reach the app.
Choose detection or blocking
Detection only logs matches and still passes traffic. Blocking returns 403 when rules or the allowlist deny a request. This applies to the app’s public URL only.