Choose a supported static egress route for Base44 API calls, account for Enterprise options and runtime limits, and verify the IPv4 addresses your vendor should allowlist.
An API allowlist checks the source address of the request that reaches it. A Base44 app needs a supported server-side egress route when its destination requires fixed source IPs.
Base44 Offers Enterprise Static Outbound IPs
Base44 lists static outbound IP addresses on its Enterprise plan. Confirm the applicable requests, environments, and configuration with Base44. Workspace-access IP allowlisting is a separate control and does not by itself assign an outbound address.
A proxy-capable external backend is another option when you want to route selected requests through QuotaGuard. The destination must accept IPv4: QuotaGuard does not provide IPv6 egress or connect directly to IPv6-only destinations.
Use a Server-Side Client That Supports the Proxy
Base44's current public compiler produces Cloudflare Workers with a Deno compatibility layer. The inspected compiler path does not provide Deno.createHttpClient, so the standalone Deno proxy pattern is not a general Base44 setup recipe. Confirm the networking APIs available to your actual app before selecting code.
If direct proxy configuration is unavailable, put the restricted API request in an authenticated external backend with a supported proxy client. Your Base44 app calls that backend, and the backend makes the vendor request through QuotaGuard. Keep credentials server-side, validate callers and inputs, and restrict the permitted destination rather than creating an open proxy.
Configure the client explicitly. A secret or environment variable does not automatically route every function or project. Verify the egress address using the same client and request path, then check the real vendor request. Register both IPv4 addresses assigned to your QuotaGuard subscription, as shown in its dashboard.
Choose the Proxy Transport for Your Backend
Choose Static or Shield according to the HTTP client's supported proxy transport and the destination's security requirements. Neither product should be selected solely because the app was built with Base44.
Use HTTPS for sensitive API calls and check any client-certificate requirements in the actual server-side client. Static source IPs do not replace authentication or establish PCI DSS, HIPAA, or SOC 2 compliance. Review the complete data path and applicable requirements with your security team.
Keep the Allowlist Aligned With the Actual Route
Use Base44's Enterprise egress when it fits your requirements, or route selected requests through a supported backend and QuotaGuard. Only requests configured to use that route receive its source addresses.
When moving a backend or changing a client, check the real outbound path again. If you retain the same QuotaGuard subscription and assigned addresses, you can keep the corresponding vendor allowlist entries rather than replacing them with the new host's addresses.
Review current QuotaGuard plans and choose a supported client and proxy route before configuring the destination allowlist.
QuotaGuard Static IP Blog
Practical notes on routing cloud and AI traffic through Static IPs.
.webp)
