New: Enforce IP whitelist for API keys

Each API key now has an Enforce IP whitelist setting. It's on by default, including for existing keys.

• On: only the IPs on the whitelist can use the key. Other requests get 403 (error code 1009).
• Off: any IP can use the key. You are responsible for its security.
• From November 1, 2026, keys with no IP addresses added stop working. Add your IP addresses, or turn the setting off for a key.

See API Keys.