Obvious/Help Center

IP Access Rules

Published February 27, 2026 · Last updated March 7, 2026 · 3 min read

This guide walks you through restricting workspace access to specific IP addresses or ranges, so only approved networks can reach your Obvious workspace.

Prerequisites

  • Workspace Owner or Admin role
  • The IP Access Rules feature enabled for your workspace (contact support if you don't see it)

Find IP Access Rules

  1. Open Settings from the sidebar.

  2. Click Security in the left navigation.

    The Security tab displays your current IP address and whether it's included in the allowlist. If no rules are configured, all IP addresses can access the workspace.

How Allowlists and Blocklists Work

IP access rules use two lists that are evaluated in order:

  • Allowlist — Only IP addresses in this list can access the workspace. Leave it empty to allow all.
  • Blocklist — IP addresses in this list are denied access, even if the allowlist is empty.

When both lists have entries, Obvious checks the blocklist first. A blocklisted IP is denied regardless of whether it also appears in the allowlist. If the IP isn't blocklisted, Obvious checks whether it's in the allowlist. If the allowlist has entries and the IP isn't in it, access is denied.

Add an IP Rule

  1. In the Security tab, find the list you want to add a rule to — Allowlist or Blocklist.

  2. Enter an IP address or CIDR range in the input field. Examples:

    • A single IPv4 address: 203.0.113.42
    • An IPv4 range: 10.0.0.0/8
    • An IPv6 address: 2001:db8::1

    Obvious validates the format as you type and flags invalid entries before you save.

  3. Add an optional label (e.g., "SF Office" or "VPN Gateway") to help your team identify the rule later.

  4. Click Add.

  5. Repeat for each IP or range you want to include.

  6. Click Save Changes when you're done.

Warning: If you save an allowlist that doesn't include your current IP address, you'll be locked out after the grace period expires. Obvious shows a confirmation dialog before saving — read it.

The Grace Period

When you save rules that could lock out your own IP, Obvious starts a 15-minute grace period before enforcement begins. During this window:

  • A countdown banner appears on the Security tab showing time remaining.
  • All IP addresses can still access the workspace.
  • You can add your IP to the allowlist or adjust rules without losing access.

Once the grace period ends, the banner confirms that IP access rules are active and enforcement begins immediately.

Tip: The Security tab shows your current IP at the top of the page with a status indicator — a green checkmark if it's in the allowlist, a warning icon if it isn't. Check this before saving.

Remove a Rule

  1. Find the rule in the Allowlist or Blocklist.

  2. Click the × button next to the rule.

  3. Click Save Changes.

Changes take effect immediately — there's no grace period for removing rules.

What Blocked Users See

When someone tries to access the workspace from a blocked IP, they see a full-page "Access Denied" screen that displays:

  • Their current IP address
  • A message to contact a workspace administrator for access
  • A Sign Out button to return to the login page

No workspace data is visible. The blocked user can't see projects, settings, or any other content.

Next Steps

Was this helpful?