What IP whitelist means

After IP whitelist is enabled, only authorized IP addresses can access the corresponding system or interface.

A typical flow is: user or server starts an access request -> the system identifies the source IP -> checks whether it exists in the whitelist -> allows access or rejects the request.

This restricts system access to network environments approved by the institution.

Applicable scope

Depending on institutional configuration, IP whitelist can be used for Finger Manager back-office access, API access, administrator operations, system-management interfaces, webhook or callback interfaces, institution-server access, and other highly sensitive entry points.

Different modules can apply independent access restrictions according to their security requirements.

Add IP addresses

Institutions can add IP addresses that are allowed to access the system.

For example: 203.0.113.10.

Depending on system support, an institution may also configure specific IP ranges.

Addresses suitable for whitelisting usually include company office fixed public IPs, institution server public IPs, data-center egress IPs, VPN fixed egress IPs, and trusted third-party system IPs.

Only network addresses that actually need system access should be added.

Access control

After IP whitelist is enabled, authorized IPs can access the system normally, while unauthorized IPs are rejected.

Even if account passwords, API Keys, or other credentials are correct, access to the corresponding service may still fail if the source IP is not allowed.

Therefore, IP whitelist works as an additional security layer beyond account authentication.

API IP whitelist

For API interfaces, institutions should add the actual server IPs that call Finger Manager API to the whitelist.

A typical structure is: institution server -> fixed public IP -> Finger Manager API -> verify IP -> verify API Key / Signature -> process request.

By verifying both source IP and API credentials, institutions can improve API access security.

Back-office access whitelist

If an institution wants Finger Manager back office to be used only from an internal network, it can set company office networks or VPN egress IPs as allowed addresses.

For example: employee -> company network / VPN -> fixed egress IP -> Finger Manager -> access allowed.

If the employee directly accesses from an unauthorized external network, the system may reject the request.

This is especially suitable for financial institutions, securities firms, risk-control departments, IT operations teams, administrator back offices, and high-privilege accounts.

Multiple IPs

If an institution has multiple offices, servers, or network egress points, multiple trusted IPs can be configured at the same time.

For example, Tokyo office, Osaka office, Hong Kong server, Singapore data center, and VPN egress can all be added according to actual needs.

Working with other security mechanisms

IP whitelist should be used together with other security mechanisms, such as multi-factor authentication, password policy, roles and permissions, API Key, request signature, HTTPS, operation logs, and login records.

IP whitelist is not a replacement for account authentication. It is an additional network-level access control layer.

Configuration notes

Before configuring IP whitelist, confirm that the current network uses stable public IP addresses.

If the institution uses dynamic IPs, a public-address change may cause previously authorized users or servers to lose access.

Before changing whitelist rules, confirm the current public IP, server egress IP, VPN egress IP, fallback access IPs, and whether running API services will be affected.

For production environments, confirm that the new IP address works correctly before deleting the old authorized address.

Example

For example, an institution only wants internal servers to call Finger Manager API.

Institution server IP: 203.0.113.10.

After adding this IP to the API whitelist: 203.0.113.10 -> API request allowed; other source IPs -> API request denied.

Even if another source obtains the API credential, it cannot directly access the interface from an unauthorized network.

Notes

IP whitelist is mainly used to restrict system access sources and improve back-office and API access security.

Institutions should configure it according to their network architecture, server deployment model, and information-security policy.

For production whitelist changes, it is recommended that an administrator with the required permission performs the change and keeps related configuration records through operation logs.