Is Employment Hero Blocking Your Replit IP? Use a Static Outbound IP

If Employment Hero rejects a Replit backend because of its cloud source address, route that client through QuotaGuard's two stable outbound IPs.

Your Replit application can have valid Employment Hero credentials and still fail to connect. One QuotaGuard customer encountered exactly that pattern while running in-house restaurant applications on Replit. The team believed the published Replit address was being rejected somewhere on the Employment Hero path and used a managed static outbound route as the workaround.

That is a strong reason to investigate the source address, but it does not prove that Employment Hero universally blocks Replit. Employment Hero's public API documentation does not publish a general Replit block or a customer-configurable source-IP allowlist. Its documented failures also include OAuth, permissions, request formatting, and rate limits.

The right troubleshooting question is therefore specific:

Does the same valid Employment Hero request fail through Replit's normal egress and succeed when the Replit backend uses a stable QuotaGuard source address?

If it does, keep the working static route. If it does not, use the response code and body to fix the actual authentication or authorization problem.

First Identify What Employment Hero Is Rejecting

Employment Hero's API is an OAuth 2.0 REST API. A failed request can occur before, during, or after the network connection. Do not assume that every 4xx response is an IP block.

Observed result	Employment Hero's documented meaning	What to check
400 Bad Request	Invalid request body or parameters	OAuth form encoding, PKCE fields, endpoint parameters, and request body
401 Unauthorized	Invalid or missing authentication token	Bearer token, expiration, refresh logic, and authorization header
403 Forbidden	Insufficient platform-user permissions for the requested resource	OAuth scopes, Employment Hero role, organization access, and endpoint permissions
429 Too Many Requests	Documented rate limit exceeded	Retry behavior and request volume
Timeout, reset, upstream denial, or behavior that changes with the source network	Not documented as a universal Employment Hero error	DNS, TLS, runtime networking, source-IP reputation, upstream filtering, and egress path

Preserve the complete status code and response body before changing anything. A documented permission error should be treated as a permission problem unless a controlled network test proves otherwise.

Employment Hero's PKCE Change Can Look Like a Network Failure

Employment Hero made PKCE mandatory for OAuth integrations on September 30, 2026. Requests that still use the older non-PKCE flow can now be rejected even though the integration worked previously.

The current requirements include:

• Generate a code_verifier and an S256 code_challenge for the authorization flow.
• Send the code_verifier during the authorization-code exchange.
• Send client_id and client_secret in an application/x-www-form-urlencoded request body for token exchanges and refreshes.
• Use a refresh token that originated from the PKCE-based flow.

Employment Hero access tokens expire after 15 minutes. An application can therefore appear healthy immediately after authorization and then fail when an outdated refresh implementation runs. A static IP cannot repair missing PKCE parameters, incorrect form encoding, an expired token, or inadequate permissions.

Check the current Employment Hero authentication documentation before treating the failure as a network block.

When a Static Outbound IP Is the Right Test

Investigate the source identity when:

• The same credentials and request work from one network but fail from the published Replit application.
• The failure began after a deployment or infrastructure change rather than an OAuth change.
• The status and body do not match Employment Hero's documented authentication, permission, validation, or rate-limit errors.
• An Employment Hero or upstream support contact identifies the observed source address as the reason for rejection.
• Routing the identical request through a different stable egress address makes it succeed.

The last comparison is the most useful. It changes one material variable: the public source address seen by the destination.

Replace Replit's Observed Egress With a Stable QuotaGuard Pair

The working path is:

Replit backend
  -> QuotaGuard managed proxy
  -> one of two assigned static IPs
  -> Employment Hero OAuth or API endpoint

The Employment Hero credentials and API request remain the same. QuotaGuard changes the source network identity presented by the selected outbound connection.

Each QuotaGuard subscription includes two load-balanced static IP addresses. If Employment Hero or another administrator asks for approved addresses, supply both so automated failover does not move traffic onto an unapproved route.

The pair belongs to the QuotaGuard subscription rather than the Replit deployment. Replit can redeploy or replace the backend while the routed Employment Hero traffic continues to leave from the same two addresses.

Use a Replit Backend, Not Browser Code

The proxy connection must originate in server-side code. Do not put the QuotaGuard connection URL, Employment Hero client secret, access token, or refresh token in frontend JavaScript.

This pattern applies to Replit backend workloads such as Autoscale, Reserved VM, and Scheduled deployments. A Static deployment serves frontend files and does not provide a persistent server-side runtime after publication.

Store the proxy URL as a Replit deployment Secret:

QUOTAGUARDSTATIC_URL=http://username:password@your-proxy-host:9293

A secret stores the credential. It does not automatically route requests. The HTTP client that opens the Employment Hero connection must be configured to use it.

Route Employment Hero Calls With Node and Undici

Replit Agent commonly creates Node applications. Node's built-in fetch uses Undici and does not automatically use an HTTPS_PROXY variable on older Node versions. An explicit Undici ProxyAgent makes the route clear and keeps it limited to the Employment Hero client.

import { fetch, ProxyAgent } from "undici";

const proxyUrl = process.env.QUOTAGUARDSTATIC_URL;

if (!proxyUrl) {
  throw new Error("QUOTAGUARDSTATIC_URL is not configured");
}

const employmentHeroDispatcher = new ProxyAgent(proxyUrl);

export async function employmentHeroFetch(url, options = {}) {
  return fetch(url, {
    ...options,
    dispatcher: employmentHeroDispatcher,
  });
}

Use the same wrapper for the API request:

const response = await employmentHeroFetch(
  "https://api.employmenthero.com/api/v1/organisations",
  {
    headers: {
      Authorization: `Bearer ${accessToken}`,
      Accept: "application/json",
    },
  }
);

const body = await response.text();

if (!response.ok) {
  console.error("Employment Hero request failed", {
    status: response.status,
    body,
  });
  throw new Error(`Employment Hero returned ${response.status}`);
}

const organisations = JSON.parse(body);

If token exchanges or refreshes also need the stable route, send those requests through the same wrapper. Continue following Employment Hero's current PKCE and form-encoding requirements. The proxy does not change the OAuth protocol.

Verify the Replit Route Before Testing Employment Hero

Use the configured dispatcher to call QuotaGuard's IP-check endpoint:

const check = await employmentHeroFetch("https://ip.quotaguard.com");
console.log("Employment Hero route exits from:", await check.text());

The result should match one of the two static addresses displayed in the QuotaGuard dashboard. This confirms that this HTTP client is using the proxy.

Then repeat the Employment Hero request and record:

• The exact endpoint.
• The HTTP status.
• The response body.
• Whether the direct Replit request fails.
• Whether the QuotaGuard-routed request succeeds.

If both requests fail with the same documented OAuth or permission error, the source address was not the solution. If only the QuotaGuard-routed request succeeds, retain the managed static route and provide both assigned addresses to the party controlling the filter.

Do Not Proxy Every Replit Connection

The explicit dispatcher above provides selective routing. Employment Hero calls use QuotaGuard while unrelated database, email, identity, and third-party traffic keeps its normal route.

This matters operationally. Selective routing:

• Keeps the static-IP requirement attached to the integration that needs it.
• Reduces unnecessary proxy traffic and latency.
• Limits the effect of a destination-specific configuration error.
• Makes logs and troubleshooting easier to interpret.
• Avoids changing OAuth callbacks or unrelated application behavior.

Why Use QuotaGuard Instead of Running a Proxy Server?

A fixed virtual machine can provide a stable outbound address. It also creates infrastructure your restaurant group, internal-app team, or software company must operate.

QuotaGuard manages:

• Two stable addresses with load balancing and automated failover.
• Proxy capacity, health monitoring, and maintenance.
• Regional infrastructure across 12 AWS regions.
• Operational support from engineers.
• A portable outbound identity that is not tied to Replit.

If the Replit application later moves to another supported hosting platform, the QuotaGuard identity can move with it. The destination does not need to approve an entirely new cloud egress design.

What About Replit's Native Static Egress?

Replit advertises static outbound IP capability for Enterprise customers. Its public material does not define every deployment type, address count, exclusivity rule, or routing behavior covered by that feature.

Use the native option when the organization already has the appropriate Replit agreement and wants platform-level egress for the applicable deployment. Use QuotaGuard when you want:

• A self-service managed route without moving the organization to a custom Enterprise agreement.
• Selective routing for Employment Hero rather than a platform-wide network change.
• An outbound identity that remains portable beyond Replit.
• QuotaGuard engineering support for the proxy route.
• Dedicated proxy infrastructure when customer-only addresses are required.

For the broader Replit setup, see the QuotaGuard Replit static-IP integration page.

Protect Employment and Payroll Data

Employment Hero integrations can handle employee names, contact details, compensation, leave, payroll-related information, and other sensitive records. A stable source IP is not a replacement for application security.

• Keep OAuth and proxy credentials in Replit's server-side Secrets.
• Request only the Employment Hero scopes the application needs.
• Use HTTPS for every OAuth and API request.
• Do not log access tokens, refresh tokens, proxy URLs, or employee payloads.
• Apply authorization controls inside the restaurant group's application.
• Monitor failed requests and unusual access patterns.
• Rotate credentials after suspected exposure.

QuotaGuard Static is the normal starting point for an HTTPS API route. The HTTPS payload remains encrypted to Employment Hero and is not decrypted by QuotaGuard. Static uses the standard HTTP proxy protocol on the Replit-to-proxy hop.

QuotaGuard Shield adds TLS protection to that hop. Choose Shield when the organization's security policy or approved compliance architecture requires it and the selected runtime supports the Shield connection method.

Starter, Production, and Business plans use stable shared IP pairs. If the organization requires customer-only source addresses and dedicated proxy resources, use QuotaGuard Enterprise dedicated infrastructure.

Turn a Suspected IP Block Into a Defensible Answer

Do not tell the business that Employment Hero blocks every Replit application. The available evidence does not support that claim.

Tell the business what you can prove:

1. The application produced a specific error through its normal Replit route.
2. The Employment Hero OAuth and permissions configuration was checked against current documentation.
3. The same HTTP client was routed through QuotaGuard and shown to use one of two stable addresses.
4. The identical Employment Hero request was tested again.
5. The working route was retained only if changing the source identity changed the result.

That gives a small team a useful solution without requiring it to operate network infrastructure or weaken the security around employee data.

Start a QuotaGuard trial and test Employment Hero through two stable Replit egress addresses. If you need dedicated addresses or help distinguishing an IP rejection from an OAuth failure, contact QuotaGuard engineering.

Frequently Asked Questions

Does Employment Hero officially block Replit?

Employment Hero's public API documentation does not identify a universal Replit block. A customer reported behavior consistent with its published Replit application's source address being rejected and used a proxy workaround. Confirm the cause with a controlled direct-versus-proxy test.

Will a static IP fix every Employment Hero 403?

No. Employment Hero documents 403 as insufficient platform-user permissions. Check the user's role, OAuth scopes, organization access, and endpoint requirements first. Use a static route when evidence shows the source network is the differentiating factor.

Why did a previously working Employment Hero OAuth integration stop working?

Check the PKCE rollout before assuming an IP block. Employment Hero made PKCE mandatory on September 30, 2026 and changed how OAuth client credentials and verification fields must be submitted.

Does the QuotaGuard URL go in Replit Secrets?

Yes. Store it as a server-side deployment Secret. Then explicitly configure the HTTP client to use it. Creating the secret alone does not route traffic.

Can a Replit frontend use QuotaGuard directly?

No. Browser code would expose the proxy credential. Route Employment Hero calls through a Replit backend such as an Autoscale or Reserved VM deployment.

Why does QuotaGuard provide two IP addresses?

The pair supports load balancing and automated failover. If the destination maintains an allowlist, register both so either healthy route remains authorized.

Are the standard QuotaGuard IPs dedicated?

No. Standard plans provide stable pairs on shared managed infrastructure. Enterprise plans provide customer-only addresses and dedicated proxy resources.

Should an Employment Hero integration use Static or Shield?

Static is the normal starting point for HTTPS API allowlisting and does not decrypt the HTTPS payload. Shield adds TLS protection to the Replit-to-proxy hop. Choose based on the organization's security review and the supported client architecture.