Gong Trusted IPs: Give Your OAuth Integration a Static IP

Route Gong API calls and OAuth token refreshes through QuotaGuard, then register both assigned static IPs in Gong's trusted-IP settings.

Gong now requires every OAuth integration to configure trusted IP addresses. If your integration runs on Heroku, Vercel, AWS Lambda, Google Cloud Run, or another serverless or autoscaling platform, its normal outbound address can change. Gong may then reject a valid API call or token refresh because it arrived from an address that is not on the integration's trusted list.

QuotaGuard gives the integration two stable outbound IP addresses without requiring your team to operate a NAT Gateway, proxy server, VPN, or dedicated egress host. Route the Gong traffic through QuotaGuard, enter both addresses in Gong, and keep the same approved network identity through deployments, restarts, scaling events, and supported hosting migrations.

Gong Requires Trusted IPs for Every OAuth Integration

According to Gong's official trusted-IP documentation, the requirement applies to anyone with an OAuth integration and is available on every Gong plan.

The trusted-IP restriction covers two different operations:

• Access Token requests: Gong checks the source address every time the integration calls the Gong API with an access token.
• Refresh Token requests: Gong separately checks the source address used to exchange a refresh token for a new access token.

Gong provides separate fields for these two lists. Most applications should enter the same two QuotaGuard addresses in both fields because the same backend normally performs API calls and token refreshes. If those operations run in different services, trace each connection separately and configure the lists to match the traffic that actually opens each connection.

The end user's browser-based OAuth authorization step is not subject to this trusted-IP check. The restriction applies to the server-side integration after authorization.

Why Serverless Gong Integrations Start Failing

Gong explicitly identifies Heroku, Vercel, Google Cloud Run, and AWS Lambda as platforms whose outbound IP addresses can be dynamic. The same problem can appear on other cloud runtimes that use shared or rotating egress infrastructure.

The application can have a valid OAuth token and still be rejected. Gong evaluates the token and the source address as separate security controls:

Serverless integration
  -> changing cloud egress address
  -> Gong trusted-IP check
  -> rejected because the current address is not registered

Allowlisting a broad cloud-provider range weakens the value of the control. Gong warns that an entire provider or regional range can include unrelated infrastructure operated by other customers. The better answer is a small, stable set that belongs to the route used by your integration.

Give Gong a Stable Source Identity With QuotaGuard

The QuotaGuard route changes only the network identity Gong sees:

Your application
  -> QuotaGuard managed proxy
  -> one of your two assigned static IPs
  -> Gong API or OAuth token endpoint

Your OAuth client ID, client secret, access token, refresh token, API URL, and application logic remain in place. QuotaGuard carries the selected HTTPS requests through a managed outbound route, and Gong sees one of the two stable addresses assigned to the QuotaGuard subscription.

Allowlist both addresses. QuotaGuard uses a load-balanced pair with automated failover, so either address can serve a request. Registering only one can cause intermittent authorization failures when healthy traffic exits through the other.

Configure the QuotaGuard Route Before Enforcing the Gong List

1. Create the QuotaGuard subscription

Choose the QuotaGuard region nearest your application or Gong traffic path. QuotaGuard operates in 12 AWS regions. The dashboard provides a credentialed proxy connection URL and two stable public IP addresses.

Store the connection URL in your hosting platform's server-side secret or environment-variable system. Do not expose it in browser code, client-side JavaScript, logs, screenshots, or source control.

QUOTAGUARDSTATIC_URL=http://username:password@your-proxy-host:9293

2. Route both Gong connection types through QuotaGuard

Configure the HTTP client responsible for Gong API calls to use the QuotaGuard proxy. Configure the client responsible for refreshing OAuth tokens as well. Setting an environment variable does not guarantee that every SDK or HTTP library will use it, so verify the behavior of the client that actually opens each connection.

Selective routing is preferable when the application also calls databases, identity providers, payment systems, or unrelated APIs. Send the Gong API and token requests through QuotaGuard while allowing unrelated traffic to keep its normal route.

3. Verify the route

Before changing Gong's trusted-IP settings, send a request through the same configured HTTP client to:

https://ip.quotaguard.com

The response should match one of the two addresses shown in the QuotaGuard dashboard. A successful check proves that request used QuotaGuard. It does not prove that a different OAuth library or background worker uses the same route, so test the actual API and refresh clients as well.

4. Add both IPs to Gong

In Gong:

1. Open Admin center.
2. Open the Settings tab.
3. Select API under Ecosystem.
4. Find the OAuth integration in the Integrations tab.
5. Open More actions and select Edit trusted IPs.
6. Enter both QuotaGuard addresses in the Access Token field, one address per line.
7. Enter both addresses in the Refresh Token field if the same backend performs token refreshes.
8. Save the configuration.

Gong enforces the list immediately after it is saved. There is no delayed activation period, so have the static route working before enforcement begins.

Do Not Forget the Refresh Token Route

A Gong integration can appear healthy immediately after authorization and fail later when its access token expires. This usually happens when API calls use the static route but the OAuth library refreshes tokens through the platform's normal dynamic egress.

API request
  -> QuotaGuard
  -> address in Gong Access Token list

Token refresh
  -> QuotaGuard
  -> address in Gong Refresh Token list

If both operations run in the same application, use the same QuotaGuard pair for both. This keeps the trusted configuration small and avoids maintaining separate address sets.

How to Diagnose a Gong Trusted-IP Failure

Gong documents different errors for API and refresh requests:

• Blocked API request: HTTP 403 with Access denied: IP address not permitted.
• Blocked token refresh: The OAuth error code access_denied.
• Invalid or revoked refresh credential: HTTP 400 with invalid_grant. This is not the same as a trusted-IP rejection.

A blocked refresh request does not consume the refresh token. Once the route or allowlist is corrected, the integration can recover without asking the customer to authorize it again.

Gong does not send partner-facing alerts when requests are blocked. Monitor API 403 responses and OAuth refresh failures in your own application so a routing change does not become a silent customer outage.

One Gong Integration Can Serve Many Customers

Gong's trusted-IP list is configured once on the OAuth integration, not separately for every customer that installs it. That makes stable egress especially important for SaaS vendors and integration providers.

If every tenant's Gong traffic runs through the same managed QuotaGuard route, the vendor maintains one small trusted list. The underlying application can scale horizontally or move between supported cloud environments without asking every customer to repeat OAuth authorization or accept a new source address.

This is also why operating a single proxy VM is not merely a hosting-price comparison. That machine becomes part of every customer's Gong connection. Your team inherits its patching, availability, capacity, failover, monitoring, and after-hours incident response.

QuotaGuard operates that infrastructure and provides the load-balanced pair, automated failover, usage visibility, maintenance, and engineering support.

Shared Static IPs or Enterprise Dedicated IPs?

QuotaGuard Static Starter, Production, and Business plans provide stable IP pairs on managed shared infrastructure. Gong still receives the same two approved addresses from your subscription, so these plans can satisfy the technical trusted-IP requirement.

An IP allowlist remains one layer of security. Gong still requires the valid OAuth credentials, and your application must continue protecting its client secret and refresh tokens.

Choose QuotaGuard Enterprise when your contract, security review, or threat model requires customer-only addresses and dedicated proxy resources. Dedicated infrastructure reduces the approved network identity to addresses reserved for your organization rather than addresses on shared managed infrastructure.

QuotaGuard Static starts at $19 per month. Static Enterprise with dedicated infrastructure starts at $219 per month.

QuotaGuard Static or Shield for Gong?

QuotaGuard Static is the normal starting point for Gong API allowlisting. For outbound HTTPS, the client creates a blind CONNECT tunnel and TLS continues to Gong. QuotaGuard Static does not decrypt the HTTPS application payload. The customer-to-proxy connection uses the standard HTTP proxy protocol.

QuotaGuard Shield adds TLS protection to the customer-to-proxy hop. Choose Shield when your security review, regulated-data architecture, or internal policy requires that additional protection and your selected runtime and client support the Shield connection method.

Shield starts at $29 per month. Shield Enterprise with dedicated IPs and proxy resources starts at $269 per month.

Why Use QuotaGuard Instead of Operating a NAT Gateway?

A NAT Gateway or self-managed proxy can provide static egress. It also gives your team another production network service to design and own.

QuotaGuard is the stronger choice for a small team that wants the Gong integration to work without becoming responsible for:

• Proxy hosts, operating systems, and security updates.
• Load balancing and failover between redundant routes.
• Capacity planning and connection limits.
• Monitoring, alerting, and after-hours incident response.
• Regional network design and infrastructure migrations.
• Preserving the approved IP identity when the application changes hosting platforms.

The result is portable. Gong continues trusting the QuotaGuard addresses even when the application deploys new instances, scales, or moves between supported runtimes.

Keep Gong OAuth Protected by More Than an IP Address

A trusted IP restricts where valid Gong credentials may be used. It does not replace the OAuth security controls around those credentials.

• Keep the OAuth client secret and refresh tokens in server-side secret storage.
• Never send QuotaGuard credentials or Gong credentials to browser code.
• Use least-privilege Gong scopes.
• Separate development and production integrations where appropriate.
• Rotate credentials according to your security policy.
• Monitor API 403 responses and token-refresh failures.
• Use dedicated QuotaGuard infrastructure when customer-only source addresses are required.

The combination is the real security improvement: Gong verifies a valid OAuth token and confirms that the request came from an approved network route.

Stop Chasing Gong Allowlist Failures

Gong has made trusted IPs mandatory for OAuth integrations. A dynamic serverless address is therefore no longer a harmless infrastructure detail. It can block API calls, break token refreshes, and take the integration offline after an otherwise routine deployment or scaling event.

QuotaGuard gives the integration a small, stable source identity while operating the availability, monitoring, failover, maintenance, and support behind it. Configure the Gong API and refresh-token traffic to use QuotaGuard, register both assigned addresses in Gong, and leave the allowlist unchanged as the application evolves.

Start a QuotaGuard trial and get the two static IPs for your Gong integration. If you need dedicated addresses, help tracing separate OAuth routes, or an architecture review, contact QuotaGuard engineering.

Frequently Asked Questions

Does Gong require trusted IPs for every OAuth integration?

Yes. Gong states that every OAuth integration must configure trusted IPs. The feature is available to OAuth integrations on every Gong plan.

Do I enter the QuotaGuard IPs in both Gong fields?

Enter both QuotaGuard addresses in the Access Token list. If token refreshes use the same QuotaGuard route, enter both in the Refresh Token list as well. If different services perform the two operations, configure each list for the source addresses that operation actually uses.

Why does QuotaGuard provide two addresses?

The load-balanced pair supports availability and automated failover. Gong must trust both addresses because either can serve a request.

Does the trusted-IP requirement affect the user's browser login?

No. Gong says the trusted-IP restriction applies to server-side API calls and token refreshes, not the OAuth authorization step performed in the user's browser.

Why is Gong returning HTTP 403?

If the response says Access denied: IP address not permitted, Gong received the request from an address outside the Access Token trusted list. Confirm that the actual Gong HTTP client uses QuotaGuard and that both assigned addresses are registered.

Why is the Gong token refresh returning access_denied?

Gong uses access_denied for a refresh request blocked by its trusted-IP list. Confirm that the OAuth refresh client uses QuotaGuard and that both addresses appear in the Refresh Token field. Gong uses invalid_grant for an invalid or revoked credential, which is a different problem.

Do I need dedicated QuotaGuard IPs?

Not for Gong's basic technical requirement. Standard plans provide two stable addresses on shared managed infrastructure. Use Enterprise dedicated infrastructure when your security policy or customer agreement requires addresses and proxy resources reserved for your organization.

Should I use QuotaGuard Static or Shield?

Start with Static for ordinary Gong HTTPS API traffic. Static does not decrypt the outbound HTTPS payload. Choose Shield when the approved architecture requires TLS protection on the customer-to-proxy hop and the application's runtime supports the required Shield connection method.