I have an issue with sign in flows. I tried adding CIDR Whitelist and Blacklist, then added nested flows verifying these tenant scoped attributes exist on a tenant, and if so - verify ip is (or not) in the respective list before approving. When I test the flow from flows UI in Descope - it works as expected. When I run it from the app - it does not work. I followed this guide: https://docs.descope.com/flows/conditions/ipaddress But a. its confusing in relation to ipAddress VS sourceIP usage, b. neither works... I verified my UI uses the correct flow by changing a screen in the flow and saw it propagated to the UI in auth flow. Any ideas?

Have you checked the audit trial ? You can see there IP , see if that what you expect

I see the expected IP, but in any case I set the blacklist CIDR to 0.0.0.0/0 so it should block nontheless

Hi, I'm Descope's AI assistant. I've put together an initial response below based on your question. --- ### The Correct Attribute to Use:

ipAddress

The supported dynamic value for IP checks in Descope flows is

{{ipAddress}}

— not

sourceIP

. There is no

sourceIP

attribute in Descope's flow condition system. Using an unsupported attribute will silently fail to match, which would explain why neither attempt works as expected. ### Two Supported Approaches for CIDR/IP Checks #### Option 1 — List-based (recommended for CIDR ranges): 1. Go to Project Settings → Lists and create a list with type

IPs/CIDR

. 2. Add your CIDR ranges or IP addresses as items. 3. In your flow, add a Condition with: - Key:

lists.<your-list-name>

- Operator:

Lists Contains

- Value:

{{ipAddress}}

This approach correctly handles both exact IPs and CIDR range matching. #### Option 2 — Regex-based (for simpler IP patterns): Use a regex pattern matched against

{{ipAddress}}

, for example:

/^192 .168 . d{1,3} . d{1,3}$/

This regex will match IP addresses that start with

192.168.

followed by two octets. ### Conclusion If you are experiencing issues with IP checks in your application, ensure you are using the correct attribute (

{{ipAddress}}

) and consider implementing one of the two recommended approaches for CIDR/IP checks. For further details, you can refer to the following documentation: • Using ipAddress in Descope Flows • Block Users by IP Address • Project Settings If you have questions about Descope's authentication, user management, or security features, I'd be happy to help with those instead.

Also, worth mentioning in this regards the docs are vague on behavior of

IP ADDRESS IN

condition. Does it resolve IP or CIDR?

try using this instead https://docs.descope.com/flows/use-cases/block-users-by-ip-address#1-create-a-list-of-banned-ip-addresses

That's a nice concept, but I need it scoped to a tenant

did you go over this doc https://docs.descope.com/flows/conditions/ipaddress#adding-permitted-ips-within-tenant ?

@Meir Wahnon yes, that's the one I see in

Remote Address

my IP

Open a ticket , and share over it, the ip you expect , the flow you use , and cf-ray where you see it doesn't work