---
title: "Restrict access to the account"
sidebar_label: "Restrict access to the account"
description: "How to restrict access to the account via the control panel and using a Selectel token (API key)"
sidebar_position: 6
---

import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import MoreVerticalIcon from '@selectel/docux/icons/more-vertical'
import {TabItemLabel} from '@selectel/docux/components'
import Formbricks from '@theme/MDXComponents/Formbricks'

# Restrict access to the account

By default, access to the account is allowed from all IP addresses. The [account owner](/access-control/user-types.mdx#account-owner) and users with the [`iam.admin`](/access-control/role-reference.mdx#iam-admin) role can restrict account access — users will only be able to log into the account from IP addresses and subnets that the account owner or `iam.admin` [have added](#add-address) to the allowed list.

Access restrictions apply to logging in through the control panel and accessing the API at addresses that include `https://api.selectel.ru`. Read more about API access and authorization in the [Request Authentication](/api/authorization/) section of the API documentation.

## Add an address to the authorized list \{#add-address}

Before adding an IP address, ensure that it is static. You can check the address type with your provider.

1. In the [control panel](https://my.selectel.ru/iam/acl/ip_rules), on the top menu, click **IAM**.

2. Go to the **ACL** section.

3. Click **Add Addresses**.

4. To retain access to your account, first add your current IP address.

5. Click **Add another address**.

6. Enter an address. You can add:

   * IPv4 address;
   * IPv6 address;
   * subnet in the format `198.51.100.0/29`.

7. Optional: enter a comment. For example, specify who the provided IP address or subnet belongs to. The maximum length of a comment is 256 characters.

8. Click **Add**. Sessions from addresses not included in the list will be terminated, and access to the account from them will be denied.

## Remove an address from the authorized list \{#delete-address}

The account owner and `iam.admin` can delete one or all addresses from which access to the account is allowed. When all addresses are deleted, all restrictions will be removed — users will be able to access the account from any address.

<Tabs queryString="amount">
  <TabItem value="one" default>
    <TabItemLabel>
      Remove one address
    </TabItemLabel>

    1. In the [control panel](https://my.selectel.ru/iam/acl/ip_rules), on the top menu, click **IAM**.
    2. Go to the **ACL** section.
    3. In the <MoreVerticalIcon /> menu for the address, select **Delete**.
    4. To confirm the deletion, enter the address.
    5. Click **Delete**.
  </TabItem>

  <TabItem value="all">
    <TabItemLabel>
      Remove all addresses
    </TabItemLabel>

    After removing all addresses, users will be able to log into the account from any address.

    1. In the [control panel](https://my.selectel.ru/iam/acl/ip_rules), click **IAM** in the top menu.
    2. Go to the **ACL** section.
    3. Click **Allow access from any address**.
    4. To confirm the deletion of the entire list of allowed addresses, click **Allow**.
  </TabItem>
</Tabs>

<Formbricks />