The QuotaGuard Engineering Blog

Explains why Gemini API IP restriction errors happen when cloud apps use dynamic IPs, and shows developers how to route API calls through a fixed outbound IP using QuotaGuard Static.

Salesforce orgs can restrict API access to Trusted IP Ranges. If your integration runs on serverless infrastructure with rotating IPs, here's how to stay whitelisted.

Explains why Facebook API calls fail from Heroku due to dynamic IPs and shows how to fix it using QuotaGuard Static as an outbound proxy. Targets developers hitting the "This IP can't make requests for that application" error.

GitHub Actions runners rotate through hundreds of dynamic IP addresses, making firewall and Artifactory whitelisting impossible. This post shows how to route workflow traffic through a static IP using QuotaGuard Shield.

Explains why CleanTalk and other WAFs block Python REST API scripts with JavaScript challenges, and how to get a static outbound IP via QuotaGuard so the IP can be whitelisted permanently.

IBKR's two API paths both enforce IP restrictions that break cloud deployments with dynamic IPs. This post explains how each restriction works and how to solve it with a static outbound IP proxy or reserved VPS address.

Cloud Functions and Cloud Run don't give you static outbound IPs by default. GCP's native fix costs $150+/month. Here's a simpler option.

Bybit's CDN blocks entire IP ranges from major cloud providers, causing 403 errors that look like auth failures. This post explains the real cause and shows how to fix it using QuotaGuard Shield with ccxt and raw requests examples.

GitHub Actions hosted runners use a massive shared IP pool. If your CI/CD pipeline needs to deploy to a firewalled server or hit an IP-restricted API, here's how to add static IPs.

Covers IP enforcement policies for all major crypto exchanges and how to fix cloud provider IP blocks using QuotaGuard Shield with a single ccxt Python configuration.

QGTunnel routes non-HTTP traffic like database connections, FTP, and SFTP through static IPs without changing your connection strings. Here's how it works and how to set it up.

Shows Loveable developers how to get a fixed outbound IP for calling the Binance API or other allowlisted services. Architecture: Loveable stores credentials, Supabase Edge Functions routes through QuotaGuard, financial data stays encrypted end-to-end with Shield.

OKX automatically deletes API keys with trade or withdrawal permissions after 14 days if no IP address is bound. This post explains why dynamic cloud IPs make that impossible and how QuotaGuard Shield solves it permanently with ccxt and OKX SDK code examples.

Binance enforces two hard IP rules that break cloud-hosted bots and scripts: keys expire after 30 days without an IP restriction, and withdrawals require a whitelisted IP. This post explains both rules and shows how to fix them with QuotaGuard Shield.

Zapier doesn't provide static outbound IPs, which blocks POST requests to APIs protected by IP allowlisting. This guide shows how to route Zapier webhooks through a QuotaGuard static IP proxy using Python code steps.

Three separate Fly.io community threads document the same problem: no stable egress IP, a native feature that doesn't cover deploys, and performance overhead. This post consolidates all three issues and shows how to route egress through QuotaGuard to get a static IP that works everywhere.

Kotak Neo's trading API is firewalled by design. It only accepts connections from pre-registered IPs. Shows how to get a static IP via QuotaGuard Shield and register it through Kotak Neo's portal.

Step-by-step guide for Kite Connect developers on cloud platforms who need a static IP after the SEBI/NSE mandate took effect April 1, 2026. Covers QuotaGuard Shield setup, kiteconnect Python SDK code, CAPTCHA note, and VPS alternative.

Step-by-step fix for Upstox API static IP restriction error after SEBI's April 1, 2026 enforcement. QuotaGuard Shield verified compatible. Covers requests, upstox-python-sdk, and Session patterns.

Explains why Dhan API calls are failing after SEBI enforcement and shows how to get a dedicated static IP via QuotaGuard Shield. Includes dhanhq Python code and VPS alternative.

SEBI's retail algo trading circular requires a dedicated static IP registered with your broker for any API order placement. Cloud platforms assign dynamic IPs by design, which means every major Indian broker will reject your API calls until you route them through a static egress IP.

Covers Vercel's native Static IPs feature and its $100/month per-project cost, then walks through QuotaGuard as a flexible, cheaper alternative for fixing GitHub and Prismic IP allowlisting failures in Vercel deployments.

For engineers deploying MCP servers in production that connect to enterprise systems with IP allowlists. Covers why dynamic cloud IPs get blocked, which systems trigger it most, and how to fix it.

AI agents running on serverless infrastructure need to call APIs behind firewalls. Those APIs need whitelisted IPs. Serverless doesn't give you stable IPs. Here's the fix.

QuotaGuard carries the Deployed on AWS badge on both Marketplace listings. If your team has an AWS EDP or PPA, purchases count toward your committed spend.

Covers why Vapi's dynamic outbound IPs break enterprise firewall rules, how to route both outbound API calls and inbound webhook traffic through QuotaGuard static IPs, and when Shield's SSL passthrough matters for voice data.

SOC 2 auditors demand proof of egress control. Static IPs solve it. Here's how we help startups answer the hardest networking question in compliance audits.

GKE Autopilot doesn't expose the node-level network controls you need to pin egress traffic to a static IP. This post covers why Cloud NAT is harder than it looks on Autopilot and how to route outbound traffic through a fixed IP using an HTTPS proxy in under 15 minutes.

Uses a real support ticket as the anchor to explain why some no-code platforms work with QuotaGuard and others don't, and gives no-code builders a practical way to evaluate their own platform before they spend time on setup.

Explains why legitimate cloud apps on AWS, Heroku, Render, and similar platforms get blocked by firewalls and anti-bot systems due to shared IP reputation, walks through real diagnostic tools to verify the problem, and shows the fix.

AWS NAT Gateway costs $45/month per AZ plus data transfer fees. A static IP proxy starts at $19/month with no hidden charges. Here's when each option makes sense.

Healthcare applications need to send encrypted data to external APIs, but regular proxies decrypt traffic mid-stream, violating HIPAA. QuotaGuard Shield uses SSL passthrough to maintain end-to-end encryption while providing compliant static IPs.

When Proximo goes down, Heroku customers lose production traffic with no support line to call. This post covers why QuotaGuard is the direct replacement and how to migrate in under 30 minutes.

Heroku apps use rotating dynamic IPs that can't be allowlisted in AWS RDS security groups. This guide shows how to route Heroku outbound traffic through a static IP so you can lock your RDS instance to two fixed addresses.

Retool Cloud runs on dynamic shared IPs that get blocked by database security groups and IP-allowlisted enterprise APIs. This guide shows how to give Retool a fixed outbound IP using QuotaGuard, covering both Cloud and self-hosted deployments.

Railway apps run on shared cloud infrastructure with rotating IPs. This guide shows how to assign a fixed static IP to Railway services using QuotaGuard, covering HTTP proxy setup, database connections, and Shield for inbound traffic.

Honest comparison of DigitalOcean Kubernetes egress IP options: native VPC NAT gateway, egress Droplet with Reserved IP, and QuotaGuard proxy. Includes setup steps, real pricing, and inbound IP coverage for webhook scenarios.

Shows D365 F&O developers how to route outbound API calls through a static IP using explicit WebProxy configuration in X++ — the only reliable fix for IP allowlisting across Dev, UAT, and Production environments.

Google Cloud Run doesn't give your functions a static egress IP. Cloud NAT works but causes connection timeouts. Here's why, and a simpler fix that takes 2 minutes.

n8n Cloud uses dynamic outbound IPs by default, which breaks integrations that require firewall allowlisting. This guide shows how to route n8n HTTP Request node traffic through a QuotaGuard static IP proxy, get a fixed egress address in under 10 minutes, and permanently solve the allowlisting problem without leaving n8n Cloud.

Netlify has no static IPs at all. Railway offers shared ones on Pro plans. If your database or API requires dedicated IP whitelisting, here's what to do on both platforms.

Render gives you a /24 range with up to 256 IPs for outbound traffic. Most APIs only let you whitelist one or two. Here's how to get dedicated static IPs on Render.

How to give AWS Lambda a static IP without a NAT Gateway. Skip $70+/month in infrastructure costs with a two-minute proxy configuration. Available directly on the AWS Marketplace

Heroku dynos rotate IPs constantly across AWS ranges. If your banking API, SQL Server, or SFTP vendor needs a whitelisted IP, here's how to get a static one without Private Spaces.

Replit assigns a new outbound IP on every deployment, breaking firewall rules and database connections. Here is how to fix it with a static IP proxy in under 5 minutes.

Vercel, Lambda, and Cloud Functions don't have static IPs. Most teams cave and whitelist 0.0.0.0/0 in MongoDB Atlas. That opens your database to the entire internet. Here's the fix.

Running PyMongo on PythonAnywhere, Netlify, or another platform that blocks custom binaries? Here's the pure-Python SOCKS5 setup that works, including the mongodb+srv and SOCK_CLOEXEC gotchas that will silently break it if you miss them.

Seeing unexpected bandwidth usage on your SOCKS proxy with MongoDB? Learn how replica set heartbeats accumulate through proxy tunnels and three practical steps to reduce your footprint.

Make rotates through 3 shared IPs per zone across thousands of users. Zone detection doesn't solve the whitelisting problem. Here's what actually works.

Route outbound traffic from Emergent-hosted apps or exported code through fixed IPs to connect to firewalled databases, payment APIs, and enterprise systems.

n8n Cloud gives you 22 rotating IPs that can change anytime. If your API vendor or SFTP server needs a static IP for whitelisting, here's how to fix it in five minutes.

Heroku is entering sustaining engineering mode. Your apps still run. Your static IPs still work. And if you migrate, your QuotaGuard IPs go with you.

Zapier doesn't have a static IP. It runs on AWS us-east-1 with millions of shared addresses. Here's why whitelisting the entire range is a security nightmare and what to do instead.

If you're using QGTunnel in transparent mode for database connections and seeing Socket::ResolutionError when calling APIs like Mailchimp, the fix is to disable transparent mode. This guide walks through the cause and the 5-minute solution.

Learn how to get static outbound IPs for Gigalixir apps. Code examples for HTTPoison, Req, Finch, and Tesla. Connect to firewalled databases and APIs.

Koyeb runs your containers on shared infrastructure with dynamic IPs. When you need to connect to a database or API that requires IP whitelisting, you need a proxy. This guide walks through the setup in about 10 minutes.

Render provides shared CIDR ranges for outbound IPs, but many firewalls and databases require individual static IPs. This guide compares native options with proxy services and shows how to connect Render apps to MongoDB Atlas and other firewalled resources.

Learn how to get a static IP for Fly.io apps. Compare native egress IPs vs QuotaGuard proxy. Includes code examples for Node.js, Python, Elixir, and Go.

A triage guide for 403 Forbidden errors in n8n HTTP Request nodes. Covers the common non-IP causes, how to identify a genuine IP allowlisting problem, and how to fix it with a static proxy on n8n Cloud.

Non-marketplace customers can now add multiple users to their QuotaGuard accounts directly from the dashboard. Learn how to invite team members via email and securely manage shared access to your static IP subscriptions.

QuotaGuard is testing early access to Heroku's next-gen Fir platform. We are ensuring full compatibility so you can migrate your static IP workflows seamlessly as Heroku modernizes its infrastructure for better scalability and performance.

Meet strict localization requirements with our new U.S. Data Residency option. Route all proxy traffic and logs exclusively through U.S. infrastructure to align with government contracts, HIPAA, and SOC 2 standards.

QuotaGuard is now live in 10 AWS regions, including new launches in Singapore and Mumbai. Reduce latency and improve performance for your global workloads by routing static IP traffic through infrastructure closer to your data.

Render is updating its outbound IP ranges starting October 2025. If your app connects to databases or APIs that require allowlisting, these changes could break your connectivity. Learn how to use a static proxy to decouple your app from Render's changing infrastructure and maintain a stable, maintenance-free allowlist.

Does your security team prohibit traffic from leaving the EU or US? Learn how QuotaGuard’s Data Residency add-on locks your static IPs and logs to a single region, simplifying your audits for SOC 2, HIPAA, and GDPR.

QuotaGuard prioritizes production uptime by manually managing "Soft Limits" instead of implementing automated hard-stops when customers exceed their plan usage. Choosing the unscalable task of human intervention over programmatic suspension prevents critical service failures and accommodates the administrative delays of enterprise upgrade cycles. This policy has generated significant long-term revenue and trust by treating infrastructure connectivity as a shared business goal rather than a metered utility.

Hard to believe it’s been 11 years that the QuotaGuard service has been alive and kicking.Hard to believe it’s been 11 years that the QuotaGuard service has been alive and kicking.Technology companies that survive over 10 years are rare. Especially ones that are self-funded with no outside investment.

Direct QuotaGuard customers can now enable Multi-Factor Authentication (MFA) for enhanced account security. Follow this quick guide to activate 2FA in your dashboard using your preferred authenticator app.

QuotaGuard has launched a new, highly accurate Health & Status page powered by Instatus. You can now subscribe to proxy-specific alerts via Email to get real-time status updates only for the infrastructure you use.

Understand the critical differences between SSL Passthrough, SSL Offloading, and SSL Termination. Learn which method ensures end-to-end zero-knowledge encryption for compliance versus which optimizes performance by decrypting traffic at the load balancer.

Getting a static IP for Digital Ocean using QuotaGuard Static IPs

If PythonAnywhere sent you to QuotaGuard to connect to a MySQL database, the fastest path is our example Python app. It demonstrates using mysql-connector-python through QuotaGuard by monkeypatching it to route via PySocks. Install PySocks and mysql-connector-python, set the QUOTAGUARDSTATIC_URL environment variable, then follow the example app’s README.md to test locally before integrating into your real app. If it fails, Support can help debug.

Until now, QuotaGuard has allowed for TLS1.0, TLS1.1, and TLS1.2 support on Inbound Proxy connections from clients to the proxy servers. However, security experts are recommending TLS1.0 and TLS1.1 be deprecated on servers. Therefore, TLS1.0 and TLS1.1 will be deprecated on QuotaGuard Static inbound proxies by March, 31st 2019.

A Ruby app can talk to corporate LDAP easily with net-ldap, until it’s deployed on Heroku and the LDAP server sits behind a firewall. Heroku does not provide a fixed outbound IP, so corporate allowlisting breaks. QuotaGuard solves this by routing outbound traffic through a load-balanced pair of static IPs via a SOCKS5 proxy that supports LDAP. After provisioning QuotaGuard, there are two integration options: 1. SOCKS wrapper script: forces outbound TCP through the SOCKS5 proxy (optionally masked so only AD traffic goes through). It’s quick to set up, but the masking can become maintenance if AD hosts change, and the wrapper is Linux-only so local dev on macOS or Windows is awkward. 2. Patched gems: use QuotaGuard’s patched socksify and net-ldap to route LDAP through the SOCKS proxy directly via Gemfile entries. This works cross-platform and avoids per-host masking work, but it depends on custom forks that may lag upstream updates.

If you are currently seeing this error when making a request through QuotaGuard Static, you need to contact our Support to get it resolved, as this is usually a result of a manual pausing of your QuotaGuard subscription.

We’re pleased to announce the Beta launch of our Inbound service which allows you to access your website via a Static IP address. This allows you to access web applications running on dynamic cloud platforms like Heroku, Gigalixir, or GCP from within a corporate environment with strict firewall controls.

One undocumented feature is its ability to route all requests through a proxy server. This can be very useful when trying to use Ruby Geocoder* with Heroku or other PaaS that hide behind shared ip addresses as it allows you to reclaim your daily request usage from Google.

We are deprecating non-Shield support for the HTTPS proxy by September 2021 for security reasons. All customers using https:// connections must migrate to the QuotaGuard Shield service. This guide provides the simple steps to move your subscription and secure your traffic.

Seeing QuotaGuard Error 1222 or 2297? This indicates your account is suspended due to exceeding usage limits or an inability to contact you for quota upgrades. This guide provides the exact steps to upgrade your plan across Heroku, AWS, and Azure, and prevent future service interruptions by updating your contact email.

Need a static IP for your Heroku app to access firewalled databases or APIs? This guide compares the two main options: building your own Squid proxy on AWS (high maintenance) versus using a hosted add-on like QuotaGuard Static for zero-config, load-balanced egress.

Hitting Google's "OVER_QUERY_LIMIT" on Heroku? Shared cloud IPs often exhaust Google Maps' free tier limits instantly. Learn why this happens and compare four solutions: client-side geocoding, retrying requests, building your own proxy, or using QuotaGuard to get a dedicated static IP.

How to Find and Download Historical QuotaGuard Invoices

Learn how to migrate from a marketplace add-on (like Heroku) to QuotaGuard’s direct service without changing your static IPs or proxy URL. Our support team can seamlessly transfer your existing configuration to a new direct account with zero downtime.

Getting a static outbound IP on Azure can be difficult since deployment IPs are often dynamic. This guide explores three solutions: pinning Azure VMs (risky), building your own EC2 proxy (complex), or using QuotaGuard Static for a load-balanced, zero-maintenance static IP available directly from the Azure Marketplace.

We noticed a few QuotaGuard Support requests for help setting up Google Cloud Static IP addresses with QuotaGuard, so we thought we’d put everything in one place for you, in case Google App Engine is a service you’re using.

We cancel services when we do not need them anymore, and I hate when SaaS companies make that painful. So we keep cancellation simple and self-serve. If you subscribed directly through quotaguard.com, cancellation is permanent and you will likely get new IPs if you ever come back since canceled IPs get rotated. To cancel: • Log into your QuotaGuard account • Click Edit Account (top right) • Click Billing • Scroll to the bottom and click Cancel Account If something is unclear or you ran into an issue, email Support.

Download your QGTunnel config from the QuotaGuard dashboard as a .qgtunnel file and store it in your project root so your app startup does not depend on our site being reachable. For multiple environments, you now have two options: keep using a launch script that selects the right .qgtunnel file, or set the QGTUNNEL_CONFIG environment variable to point to the correct config per environment. QGTUNNEL_CONFIG requires the April 2021 (or later) qgtunnel release. Update via: curl https://s3.amazonaws.com/quotaguard/qgtunnel-latest.tar.gz | tar xz

QuotaGuard Static and QuotaGuard Shield are now available on the Microsoft Azure Marketplace. To sign up, find the QuotaGuard Static IP listing in the marketplace and follow the Azure signup flow. If you need a walkthrough, we have a short video showing how to add QuotaGuard Static IPs to Azure. Support can help if anything doesn’t match your account or portal view.

We’re live on AWS Marketplace. QuotaGuard Shield and QuotaGuard Static are both available there now. Same products and team. The difference is you can buy and run QuotaGuard through AWS. If you need help getting a static IP working on AWS, contact Support.

QuotaGuard Shield is now generally available on Heroku. It’s QuotaGuard Static with a key difference for inbound traffic: SSL passthrough. Incoming SSL is not decrypted at our load balancer. It’s passed to your Heroku app to decrypt, which matters when certificate handling and security controls need to stay on your side. By contrast, QuotaGuard Static uses SSL termination, which requires certificates on our infrastructure so we can decrypt and forward requests. Shield removes that requirement. SSL is configured entirely in Heroku, and you can use Heroku ACM. QuotaGuard Shield on Heroku is also positioned as HIPAA compliant for securely transferring sensitive data.

Do you need to change your credit card for your QuotaGuard subscription? It’s pretty simple and available in our dashboard.

Azure makes canceling QuotaGuard weird because the QuotaGuard resource page often has no delete action. The reliable workaround is to use All resources, find the QuotaGuard subscription in the list, select it using the checkbox (do not click into it), then delete it from the list view. If Azure changes the UI again, support can help. Credit to Dan Kroymann at RecRoom.com for the workaround.

To change your QuotaGuard plan on Azure, log into the QuotaGuard admin panel, open the account menu on the right and choose Edit Account, then go to Billing. Under Subscription Plan, click Change Plan, pick the new plan, and confirm. Plan changes do not change your IPs or connection URL, and they should not interrupt service.

We regularly get asked how to attach QuotaGuard Static or QuotaGuard Shield to a specific Heroku app. Process: open the target app in the Heroku dashboard, go to Overview, find Installed add-ons, click Configure add-ons, search for “QuotaGuard,” pick the add-on and plan, then click Provision. After provisioning, use the arrow next to the add-on to jump into the QuotaGuard admin panel and grab settings and connection details. Heroku also emails the connection info.

If you find yourself trying to route through QuotaGuard from the Azure function App, we wanted to post this sample code as a possible solution.

We updated QuotaGuard inbound proxies to support the same load-balanced setup as our other proxies. Instead of a single static IP, load-balanced inbound proxies now use two static IPs behind a load balancer. What changes on your side: • Update IP allowlists to include both inbound proxy IPs (two addresses). • If you use a custom domain, switch DNS from an A record to a CNAME pointing at the provided hostname. Example: • dae5060e659305e4-us-east-1.getstatica.com allowlist: 10.10.10.1, 10.10.10.2 • test-inbound.quotaguard.com set as CNAME -> statica.quotaguard.com, allowlist: 10.10.10.1, 10.10.10.2 We can enable the load-balanced setup for your existing inbound proxy, or keep you on the prior single-IP setup.

Quick update regarding the forthcoming GDPR Privacy law going into effect in the EU region.

QuotaGuard Dynamic IPs are meant to make Google Maps Geocoding API usable from platforms like Heroku by spreading requests across many proxy machines. That avoids OVER_QUERY_LIMIT from per-IP throttling until you hit Google’s daily cap (2,500 as of Nov 2013). But Google also rate-limits per second. If you exceed roughly 4 requests per second, you can still get temporary OVER_QUERY_LIMIT responses. The practical fix is retries with backoff, which usually shows up during bulk geocoding jobs (often a Ruby rake task). The example approach is: geocode each record, check whether it actually geocoded, and if not, sleep briefly and retry a few times. Caveat: the Ruby Geocoder gem does not reliably raise on failures, so the “not geocoded” check can trigger retries for bad addresses too.