---
title: "Update token IP allowlist"
method: PUT
path: "/account/tokens/{lookup_id}/allowed-cidrs"
tags: ["Token"]
---

# Update token IP allowlist

`PUT /account/tokens/{lookup_id}/allowed-cidrs`

Replace the IP CIDR allowlist for an auth token. Empty array clears the allowlist (unrestricted). Only callable from the main account session; subkey sessions cannot modify token allowlists.

## Path parameters

- `lookup_id` string, required

## Request body

- RequestsUpdateAllowedCIDRs
  - `allowed_cidrs` string[] — Full replacement list. Empty = unrestricted.

## Response `200`

Updated token details

- ResponsesApiToken
  - `allowed_cidrs` string[] — IP CIDR allowlist; empty means unrestricted
  - `created_at` integer — Token creation timestamp (nanoseconds since epoch)
  - `expiry_at` integer — Expiration timestamp (nanoseconds since epoch)
  - `kind` string — Token type (jwt, api_key, etc.)
  - `last_updated_at` integer — Last modification timestamp (nanoseconds since epoch)
  - `lookup_id` string — Identifier used for the token lookup
  - `name` string — User-provided token name
  - `revoked_at` integer — Revocation timestamp (nanoseconds since epoch, 0 if not revoked)
  - `token_id` string — Unique ID for the auth token

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — IP restrictions not enabled for this account
- `404` — Not Found

---

[API](https://skmtc.net/tradeparadex/apis/paradex-rest-api-2.md) · [All operations](https://skmtc.net/tradeparadex/apis/paradex-rest-api-2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/tradeparadex/paradex-rest-api-2/revisions/e8fca3e578c7/schema)