# How to allow refresh\_token based user ip?

**URL:** <https://forum.keycloak.org/t/how-to-allow-refresh-token-based-user-ip/26931>\
**Category:** Getting advice\
**Tags:** admin-console, authentication, oidc\
**Created:** [July 10, 2024, 1:16am UTC](https://forum.keycloak.org/t/how-to-allow-refresh-token-based-user-ip/26931 "2024-07-10T01:16:11Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![sdkim81](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/sdkim81/32/10861_2.png) [@sdkim81](https://forum.keycloak.org/u/sdkim81)\
**Post date:** [July 10, 2024, 1:16am UTC](https://forum.keycloak.org/t/how-to-allow-refresh-token-based-user-ip/26931/1 "2024-07-10T01:16:11Z")

</div>

Hello,

Is there any way to meet this requirement in keycloak?

Requirement : Service owner want to control user login based on origin IP.  
e.g) protocol/openid-connect/auth , protocol/openid-connect/token

What I did for this requirement is,

1. Implement new SPI that check user IP.
2. Add this to Authentication flow \> browser  
==\> Now I can control user login via oauth2 (authorization code) flow if user IP isn’t in allowed list.

But problem is, it doesn’t work when user try to get a new access token with refresh\_token (grant\_type = refresh\_token).

Is there any way to insert custom execution for /token API?

Thank you in advance.