---
id: troubleshooting.authentication
title: IP access restriction
summary: Resolve the current Access Restricted page when the detected IP is not on the Workspace allowlist.
kind: error
product_area: troubleshooting
status: stable
updated: 2026-08-23
canonical: /docs/troubleshooting/authentication
---

# IP access restriction

Use this when Teammately displays **Access Restricted** and says the current IP is not on the Workspace allowlist. Sign-in, Project membership, and Contribution assignment are separate problems.

## Symptom

The page reports **Access restricted by IP** and shows a detected client-header IP, backend-detected IP, or both.

## Likely causes

- The current IPv4 or IPv6 address is not on the Workspace allowlist.
- A VPN, proxy, gateway, or network change caused the detected address to differ from the expected address.
- The client-header and backend-detected addresses differ, so the administrator needs the value actually shown by the product.

## Diagnostic checks

- Read both detected IP values shown on the page.
- Confirm whether the user recently changed networks or enabled a VPN.
- Copy the displayed address instead of relying on an address from another device or external lookup.
- If the page no longer appears but Project content is still unavailable, continue with permissions troubleshooting.

## Fix

- Send the displayed IP to the Workspace administrator.
- Have the administrator add the required single address or CIDR in the applicable security settings.
- Retry after the allowlist change is active. If the detected address changed again, resolve the network or VPN source before adding more entries.

## Prevention

- Confirm the expected access network before time-sensitive Contributions or evaluations.
- Prefer a stable organizational network path when the Workspace uses IP restrictions.
- Keep IP restriction, Project membership, and Contribution assignment diagnoses separate.

## Related task pages

{% related-card-grid title="Related task pages" %}
- [Request an Expert Contribution](/docs/expert-contributions/request-contribution)
- [Reviewing cases](/docs/expert-contributions/complete-contribution)
- [Product quickstart](/docs/quickstart)
{% /related-card-grid %}

## Related reference pages

{% related-card-grid title="Related reference pages" %}
- [Permissions](/docs/reference/permissions)
- [Reviewer and project access](/docs/governance/reviewer-and-project-access)
- [Workspaces, projects, and target systems](/docs/object-model/workspaces-projects-and-target-systems)
{% /related-card-grid %}

## Source confidence

Code-backed: the Access Restricted route displays the client-header and backend-detected IP values, provides copy controls, and directs the user to an administrator for allowlisting. This page does not claim a broader sign-in or authentication contract.