Anthropic adds IP allowlisting and a sign-out-everywhere call to Claude, in beta
Anthropic added two access controls to Claude on 5 November 2026, according to its Claude Platform release notes. An organisation admin can now restrict Console and API access to up to 1,000 approved IP ranges, and an Admin API call signs a member out of Claude on every browser and device. Anthropic says both are in beta. A request from an address outside the list gets a 403 permission_error from the Messages API.
Why it matters: A leaked API key is a billing and data problem, and an allowlist means a stolen key fails from the attacker's network. Anthropic's own docs add a limit: the list says where a key works, not for how long, so Anthropic also recommends a short key expiry or Workload Identity Federation, which replaces static keys.
The catch: Coverage stops at Anthropic's own platform. Anthropic's docs list Claude in Amazon Bedrock, Claude Platform on AWS, Claude Models on Google Cloud and Claude in Microsoft Foundry as not covered, so teams buying Claude through a cloud marketplace gain nothing here. The sign-out call also ends the person's whole Claude account sessions, including other organisations and personal plans, and the member keeps their seat and can sign back in at once. To keep someone out, remove them or disable them in your identity provider. Anthropic says changes can take up to 15 minutes, and that the save-time check confirms only your current address is on the list.
What to do: Before turning the allowlist on, pull 30 days of API logs and list every address that calls Claude: data centres, CI runners, offices, VPNs, proxies and sandbox workers. Add them all, then watch for 403 errors for a full week, since a job that runs weekly will fail only then. Write the sign-out call into your offboarding runbook next to the identity-provider step, and add the IP allowlist to the Compliance API Activity Feed review so changes to the list get noticed.
Our coverage →Anthropic: Claude Platform release notes (5 November 2026) ↗Anthropic docs: IP allowlisting (beta) ↗Anthropic docs: User management, sign a member out everywhere ↗