https://httpbin.org/ip will return the public interfacing IP address of the source. So the whitelist should happen as long as you pass in the IP address received from the IP endpoint.
If you try to access the gateway from any other IP, the result should be
{
"error": "access from this IP has been disallowed"
}
To help resolve the issue, can you share your API definition?