ip_not_allowed

HTTP 403. The key is valid, but it carries an IP allow-list and this request did not come from an address on it. A key with an empty allow-list is unrestricted, so this never fires for one.

What to do: Call from an allowed address, or change the key’s ip_allow_list. The match is against the client IP the edge observed, not one the caller can set.

Every error is an RFC 9457 problem document - match on code (stable forever), show detail to humans, and quote instance when reporting an occurrence to support.