Hi @hirak X-Forwarded-For: We don’t consider the X-Forwarded-For header. The request origin IP is taken at our CDN level, so API users can’t forge it. Trusting a client-supplied header would let anyone pass the registered IP and defeat the purpose of the static IP requirement.