#Restricting downloads by IP address

Use a download IP allowlist to distribute your app through a corporate network, VPN, or a download server with fixed public IP addresses. Requests from addresses outside the allowlist receive HTTP 403.

The policy applies to the app's ToDesktop download links, direct artifact URLs, custom download domains, update manifests, and Debian APT and Arch Linux pacman repository responses. It is managed through the downloadAccess API. Apps without a policy remain public. There is currently no dashboard setting for this feature.

#Prepare the app and network

1. Contact ToDesktop to enable private downloads for your app.
2. Identify the public IPv4 and IPv6 addresses used by your network or download proxy. Include every public address that legitimate downloads may use. Local addresses on a device or server are not its public source address.
3. Prepare an access token belonging to the app owner. A personal token must be scoped to this app. Collaborators can read the policy but cannot change it.
4. Confirm how installed apps will reach update checks and downloads. They must use an allowed network or proxy too; installing from an allowed network does not grant access from other networks later.

For user-authenticated downloads, have your server authenticate the user and fetch the file from ToDesktop using an allowed public IP address. Send the file back through your server; redirecting the browser to ToDesktop makes the download use the user's IP address instead.

#Set the policy

Use the API reference to:

• Read the current policy.
• Set or replace the allowlist.
• Restore public downloads.

Each PUT supplies the complete policy. For example, adding a new network requires including the existing networks you want to retain.

#Verify downloads and updates

After a successful PUT, test a download from both an allowed network and a network outside the allowlist. Repeat this for direct artifact URLs, your custom download domain if used, and the installed app's update flow.

An allowed address can download normally. An address outside the allowlist receives 403.

If your download links redirect to another ToDesktop app, each app in the chain is checked. Restrict every target app whose artifacts must remain private; restricting one app does not protect another app's independent download links. Redirects to external update feeds are not supported for restricted downloads.

These restrictions control future downloads. They do not revoke copies that users have already downloaded or control access to data inside your app.