> ## Documentation Index
> Fetch the complete documentation index at: https://apidocs.finrock.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Whitelist Withdrawal Addresses

> Group pre-approved addresses, such as your cold storage and trusted partners, into whitelists so funds only leave your account for places you trust.

Address whitelisting is a security layer for withdrawals: you keep lists of pre-approved wallet addresses, and use [spending rules](https://apidocs.finrock.io/guides/spending-rules.md) to send funds only to those addresses. It reduces the risk of phishing, hacks, human error and compliance issues.

For businesses, whitelisting means funds only go to places you trust, such as partners, your own addresses on other platforms, or cold storage.

> [!NOTE]
>
> This guide is about withdrawal addresses. To restrict which IP addresses can use an API key, see [Whitelist IPs](https://apidocs.finrock.io/guides/whitelist-ips.md).

## How whitelists work

A **whitelist** is a named list of addresses, for example `Cold storage` or `Partner payouts`. Each address in a whitelist has:

| Field | Description |
| - | - |
| **Asset** | Optional. If set, the address is used only for that asset. If empty, it's used for any asset. |
| **Label** | A name to help you recognise the address, such as `Treasury cold wallet`. |
| **Address** | The wallet address, with the date and time it was added. |
| **Status** | Whether the address is active, for example **Active**. |

You can keep several whitelists, each grouping addresses for one purpose.

## Create a whitelist

**1. Open Whitelists**

In the Finrock dashboard, go to **Policy** and select **Whitelists**. You'll see your whitelists, each with its name and status.

**2. Add a whitelist**

Click **Add a Whitelist** and give it a name that describes its purpose, such as `Cold storage`.

**3. Get it approved**

A new whitelist takes effect once the owner, or at least 2 admins, approve it.

To rename a whitelist later, click the edit icon next to its name.

## Add an address to a whitelist

**1. Open the whitelist**

On **Policy → Whitelists**, click **View** next to the whitelist. You'll see its addresses with their asset, label, address and status.

**2. Add the address**

Click the **+** button, then enter:

* **Address:** the wallet address you want to allow. Check it carefully: funds sent on-chain can't be reversed. You can check the format with [Validate Address](https://apidocs.finrock.io/api-reference/wallets/validate-address.md).
* **Label:** a name to help you recognise it later.
* **Asset (optional):** pick an asset to use the address only for that asset, or leave it empty to use it for any asset.

**3. Check it's active**

The address appears in the list with its status. It becomes **Active** once the account owner, or at least 2 admins, approve it.

## Remove an address

Open the whitelist with **View**, then click the delete icon next to the address.

## Use a whitelist in spending rules

Whitelisting an address doesn't send funds on its own. Outgoing transactions are blocked by default, so you also need a [spending rule](https://apidocs.finrock.io/guides/spending-rules.md) that allows them.

Create a rule with destination **External** and choose your whitelist. In the API, set `destination_id` to `WhitelistedAddress` and `external_address` to the whitelist's ID. You can find the ID in the dashboard or through the API. A withdrawal then matches the rule only if its address is on that whitelist and active, with a matching asset and destination tag.

> [!TIP]
>
> Keep treasury and cold-storage sub-accounts limited to whitelisted addresses. Use [ad-hoc addresses](https://apidocs.finrock.io/guides/ad-hoc-addresses.md) only on sub-accounts where customers give their own withdrawal address.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.