Polygon.io API Key IP Restrictions Bypassed via Proxy Servers

API Key Access Control Configuration

Polygon.io allows restricting API keys by IP address and HTTP referrer through the dashboard's API Settings > Restrictions panel. These controls are intended to prevent unauthorized usage when keys are accidentally exposed in client-side code or logs. However, IP restrictions alone may not provide sufficient protection in environments where outbound proxy servers are available.

The current concern involves whether an attacker in control of a proxy server can circumvent IP-based restrictions by routing requests through allowed IP addresses. This becomes particularly relevant for services that operate behind corporate proxies or in cloud environments with shared egress IPs.

The verification process requires testing key behavior from an unrestricted IP using curl while routing through a proxy server that terminates at an allowed IP. Documentation does not explicitly state whether the platform validates the original client IP or only the terminating proxy IP.

Unresolved questions:

• Does Polygon.io validate the original client IP address when requests pass through an HTTP proxy?
• Are there specific proxy configurations that bypass IP-based restrictions?
• What combination of restrictions (IP + HTTPS + referrer) provides complete protection against proxy-based circumvention?