# Limits & Access — Budgets, IP Allowlists and Allowed Models

Source: https://ofox.ai/docs/develop/limits-access

Manage your whole team's budgets and access rules in one place under **Settings → Limits & access** in the console. This prevents unexpected overspending and stops a leaked API key from being abused.

| Rule | What it does | Where to set it |
|------|------|------|
| Budget cap | Stops calls once the cap is reached | Team, members: Limits & access; keys: API Keys |
| IP allowlist | Allows calls only from specified servers | Team: Limits & access; keys: key menu → **IP Whitelist** |
| Allowed models | Limits which models can be called | Team: Limits & access; keys: key menu → **Allowed models** |
| Request rate | Requests per minute shared by all keys in the team | View only; see [Rate Limits](https://ofox.ai/docs/develop/guides/rate-limits) |

Only team Owners and Admins can change these rules. Every change is recorded in **Change history** at the top right of the page.

## Budget caps

Budgets apply at three levels — team, member and API key — and the period can be **Daily**, **Monthly** or **Total**.

- **Team budget**: the spending cap for the whole team
- **Default member budget**: counted per member; if a member has their own budget, that one applies instead
- **Key budget**: set for an individual key on the **API Keys** page

Each level is counted separately, and **a request is blocked as soon as any level runs out**. Within the same period, a key budget can't exceed its member's budget, and a member budget can't exceed the team budget.

Each budget has an action:

| Action | When the cap is reached |
|------|------|
| Notify and block | Sends an email alert and stops calls |
| Notify only | Sends an email alert only; doesn't block |

Topping up does not restore calls once a budget is used up. Raise the cap, or wait for the daily / monthly period to reset.

## IP allowlist

Allow calls only from specified IPv4 addresses or CIDR ranges, up to 100 entries. Requests from addresses not on the list are rejected.

- **Team IP allowlist**: applies to every API key in the team
- **Key IP allowlist**: narrows the team list further for a single key; an address on a key's list only takes effect if it's also on the team list

This is a good way to lock production keys to your own servers: even if a key leaks, no one can call with it from anywhere else.

## Allowed models

Teams can choose one of three modes, and models can be selected in bulk by vendor:

| Mode | Description |
|------|------|
| All models | Every model can be called, including models released later |
| Only these models | Only models on the list can be called; models released later can't be called either |
| Block these models | Models on the list can't be called; other models are unaffected |

An individual key can be narrowed further under **Allowed models** in the key menu. Team and key rules apply together: only models allowed by both can be called.

## Check effective rules

Each key is governed by both team rules and key rules. In **API Keys**, open the key menu and click **Check effective rules**, then pick a model to see whether a call would be blocked, which rule would block it, and how much budget is left. Checking doesn't use credits.

## Responses when a request is blocked

Requests blocked by a budget or access rule won't succeed on retry; adjust the rule first:

| Status | Error code | Cause | What to do |
|------|------|------|------|
| `402` | `spending_limit_exceeded` | The team, member or key budget cap was exceeded | Raise the cap, or wait for the period to reset |
| `402` | `insufficient_credits` | Insufficient balance | Top up |
| `403` | `ip_not_allowed` | The caller IP is not on the allowlist | Add the IP to the team or key allowlist |
| `403` | `model_not_allowed` | The team or key doesn't allow this model | Use another model, or change the allowed models |
| `503` | `spending_limit_check_unavailable` | The budget can't be confirmed right now | Retry later |

Blocked requests appear under the **Blocked** filter in **Activity**. For the full list of error codes, see [Error Handling](https://ofox.ai/docs/develop/guides/error-handling).

## Change history

For the IP allowlist, allowed models and budgets, you can see who changed what and when in **Change history** at the top right of **Limits & access**. Log retention settings aren't recorded here; see [Request Logs](https://ofox.ai/docs/develop/observability/request-logs).