Give Activepieces a Static Outbound IP for Firewall Allowlisting

Add https-proxy-agent to an Activepieces code piece, point it at QUOTAGUARDSTATIC_URL, and every outbound request to your firewalled API clears the allowlist in 2 minutes.

Activepieces is one of the fastest-growing n8n alternatives. It has the same problem: shared cloud infrastructure means rotating outbound IPs, and rotating IPs mean firewall rejections.

Firewall Allowlisting Requires a Fixed Egress IP

Every outbound request from an Activepieces Cloud flow leaves from a shared pool of addresses across Activepieces' infrastructure. The IP your firewalled database or API sees on one run isn't the same IP it sees on the next. There's no mechanism to pin it.

This comes up repeatedly in the Activepieces community. GitHub issue #9463 asks for a publicly available endpoint listing Activepieces' outbound IPs specifically because users need to allowlist them with their own services. The community forum has multiple threads on the same problem. Activepieces published a set of outbound addresses at one point, but those addresses aren't guaranteed stable.

A stable allowlist needs a stable IP. Routing your flows through a proxy gives you one.

Activepieces Cloud Gets a Fixed IP via a Code Piece

Activepieces code pieces run Node.js and support npm packages. That means https-proxy-agent works, which is the same approach used with n8n and Pipedream.

First, set your QuotaGuard Static URL as a connection or environment value in your Activepieces workspace. Then add a Code piece to your flow and configure the outbound request through the proxy agent:

import { HttpsProxyAgent } from 'https-proxy-agent';

const proxyUrl = 'http://username:password@proxy.quotaguard.com:9293';
const agent = new HttpsProxyAgent(proxyUrl);

const response = await fetch('https://your-restricted-api.example.com/endpoint', {
  agent,
  method: 'GET',
  headers: {
    'Content-Type': 'application/json',
  },
});

const data = await response.json();
return data;

Replace username:password with your QuotaGuard credentials. Replace the destination URL with your actual API endpoint. The IP that the destination sees is the QuotaGuard egress IP. It stays the same across every flow run, every redeployment, and every Activepieces infrastructure change.

QuotaGuard tip: proxy only the specific calls that need a fixed IP. Don't route all traffic through the proxy. It's faster to debug and easier to maintain when the proxy scope matches the allowlisting requirement exactly.

Self-Hosted Activepieces Gets a Fixed IP With One Environment Variable

If you're running Activepieces self-hosted, you have a cleaner path. Node.js respects the HTTP_PROXY and HTTPS_PROXY environment variables at the process level. Set them in your .env file or Docker Compose configuration, and all outbound HTTP requests from your Activepieces workers route through the proxy automatically. No code changes. No per-flow configuration.

Add these to your Activepieces environment:

HTTP_PROXY=http://username:password@proxy.quotaguard.com:9293
HTTPS_PROXY=http://username:password@proxy.quotaguard.com:9293

Restart your Activepieces instance. Every outbound request from every piece in every flow now leaves from the same static IP. Your database firewall team gets one address to allowlist and nothing changes when you update flows, add pieces, or scale workers.

Pick the QuotaGuard region closest to the API or database you're calling. Available regions span US-East, US-West, EU-West, EU-Central, AP-Northeast (Tokyo), AP-Southeast (Singapore), AP-Southeast-2 (Sydney), AP-South (Mumbai), CA-Central, and SA-East (São Paulo). Use the regional hostname format: http://username:password@eu-west-static-01.quotaguard.com:9293.

QuotaGuard Shield Encrypts Regulated Data End-to-End

If your Activepieces flows handle healthcare records, payment data, PII, or any regulated workload, use QuotaGuard Shield instead of Static. Shield uses SSL passthrough. QuotaGuard routes your traffic but never decrypts it. Your data stays encrypted between Activepieces and the destination. That satisfies HIPAA, PCI-DSS, and SOC 2 requirements around third-party data handling.

For Shield, use QUOTAGUARDSHIELD_URL as the environment variable, port 9294, and https:// in the proxy URL. Shield plans start at $29/month.

One Static IP, Every Flow, Every Piece

The proxy approach scales with your automation stack. New pieces, new flows, new integrations: they all inherit the same fixed egress IP without any additional configuration. Your compliance team gets a one-line answer to "what IP does Activepieces call from?" Your API vendors and database admins allowlist it once and you're done.

QuotaGuard Static plans start at $19/month. Setup is 2 minutes. Review the tiers at quotaguard.com/products/pricing and pick the one that fits your outbound traffic volume.