function restrict_rest_api_by_ip($access) {
    // Define allowed IP addresses
    $allowed_ips = ['192.168.1.100', '203.0.113.0'];

    if (!in_array($_SERVER['REMOTE_ADDR'], $allowed_ips)) {
        return new WP_Error('rest_forbidden', 'Your IP address is not allowed to access the API.', ['status' => 403]);
    }

    return $access;
}

add_filter('rest_authentication_errors', 'restrict_rest_api_by_ip');