Skip to main content
Address whitelisting is a security layer for withdrawals: you keep lists of pre-approved wallet addresses, and use spending rules to send funds only to those addresses. It reduces the risk of phishing, hacks, human error and compliance issues. For businesses, whitelisting means funds only go to places you trust, such as partners, your own addresses on other platforms, or cold storage.
This guide is about withdrawal addresses. To restrict which IP addresses can use an API key, see Whitelist IPs.

How whitelists work

A whitelist is a named list of addresses, for example Cold storage or Partner payouts. Each address in a whitelist has: You can keep several whitelists, each grouping addresses for one purpose.

Create a whitelist

1

Open Whitelists

In the Finrock dashboard, go to Policy and select Whitelists. You’ll see your whitelists, each with its name and status.
2

Add a whitelist

Click Add a Whitelist and give it a name that describes its purpose, such as Cold storage.
3

Get it approved

A new whitelist takes effect once the owner, or at least 2 admins, approve it.
To rename a whitelist later, click the edit icon next to its name.

Add an address to a whitelist

1

Open the whitelist

On Policy → Whitelists, click View next to the whitelist. You’ll see its addresses with their asset, label, address and status.
2

Add the address

Click the + button, then enter:
  • Address: the wallet address you want to allow. Check it carefully: funds sent on-chain can’t be reversed. You can check the format with Validate Address.
  • Label: a name to help you recognise it later.
  • Asset (optional): pick an asset to use the address only for that asset, or leave it empty to use it for any asset.
3

Check it's active

The address appears in the list with its status. It becomes Active once the account owner, or at least 2 admins, approve it.

Remove an address

Open the whitelist with View, then click the delete icon next to the address.

Use a whitelist in spending rules

Whitelisting an address doesn’t send funds on its own. Outgoing transactions are blocked by default, so you also need a spending rule that allows them. Create a rule with destination External and choose your whitelist. In the API, set destination_id to WhitelistedAddress and external_address to the whitelist’s ID. You can find the ID in the dashboard or through the API. A withdrawal then matches the rule only if its address is on that whitelist and active, with a matching asset and destination tag.
Keep treasury and cold-storage sub-accounts limited to whitelisted addresses. Use ad-hoc addresses only on sub-accounts where customers give their own withdrawal address.