SETSimple Easy Transactions
SET DocsAPI reference and complianceUpdated 2026-11-10
Browse: SET Merchant API

SET Merchant API · API keys

Pin a key to your servers' addresses

POST/v1/api_keys/{id}/allowed_cidrs

Key scope: write

Sets the addresses an active key may be used from: up to 20 IPv4 or IPv6 addresses or CIDR ranges, or [] for any address. A request with the key from anywhere else is refused with 403 ip_not_allowed. Event api_key.allowed_cidrs_changed.

Path parameters

id stringrequired
The key's id.

Headers

Idempotency-Key string
Optional. The same key and body run once; a replay answers with Idempotent-Replayed: true. Kept 24 hours.

Body

allowedCidrs string[]required
The full list; it replaces the one before. [] allows any address again.

Notes

  • A key cannot shut itself out: changing the calling key's own list to one that leaves out the address you are calling from is 409 would_lock_out. Add the address, or make the change with another key.
  • The address checked is the one SET's network edge sees your request come from. A request that carries none is refused.

Errors

  • 400 cidrs_invalid
  • 404 api_key_unknown
  • 409 would_lock_out
  • 401 api_key_required
  • 401 api_key_invalid
  • 401 api_key_wrong_mode
  • 403 scope_missing
  • 429 rate_limited

All codes: Errors.