How to Set a Static Outbound IP on Scalingo in Your App Code

Scalingo apps don't get a fixed outbound IP that belongs to them. Egress runs through a shared regional pool, shared with every other app in the region, and Scalingo's documentation says those IPs can change with 30 days' notice. Any partner API that allowlists source IPs will eventually reject your requests, or force you to trust a pool you share with every Scalingo tenant. Route the calls that hit those destinations through a static IP proxy and you allowlist two fixed addresses that are yours. This guide is the step-by-step setup. For inbound static IPs, database connections, and the full EU residency options, see the Scalingo static IP integration page.

Scalingo Egress IPs Are Shared and Change

Scalingo apps leave through a shared regional egress pool, resolved by a regional hostname such as egress.osc-fr1.scalingo.com. The addresses are shared across every app in the region, and Scalingo's egress documentation states the list can change in the future, with at least 30 days' notice. That makes IP allowlisting fragile: you are trusting a shared pool, and you have to track the list and update allowlists when it changes. Scalingo's IPSec and OpenVPN addons do not solve this. They tunnel your app into your own private network, they do not give you a public fixed egress IP for a third-party allowlist.

QuotaGuard Static Gives You Two Fixed IPs to Allowlist

QuotaGuard Static is an HTTP, HTTPS, and SOCKS5 proxy running on AWS. Every account is assigned two static IP addresses behind a load balancer, and those two IPs don't change. You add both to your destination's firewall or API allowlist, route your app's outbound calls through the proxy, and every request exits from one of those two addresses no matter how Scalingo updates its shared pool. Your two assigned IPs are shown in your QuotaGuard dashboard after sign-up.

Set Your Proxy URL as a Scalingo Environment Variable

Store the proxy URL from your QuotaGuard dashboard as an environment variable on your app, using the dashboard or the Scalingo CLI. Then restart so the variable is available to your running app.

scalingo --app your-app env-set QUOTAGUARDSTATIC_URL="http://username:password@proxy.quotaguard.com:9293"
scalingo --app your-app restart

Keep the connection string in the environment, not in your source code, so you can rotate it without a redeploy.

Route Only the Calls That Need the Static IP, in Your Code

Attach the proxy to the specific requests that hit an allowlisted destination, rather than forcing all traffic through it. This keeps your Scalingo addon connections, like PostgreSQL and Redis, on the platform's private network where they belong, and it means a proxy issue can only affect the calls you deliberately routed.

In Node.js, read the proxy URL from the environment and pass an agent on the individual request. The agent option is honored by node-fetch. Node's built-in fetch ignores it and needs an undici dispatcher instead.

const fetch = require('node-fetch');
const { HttpsProxyAgent } = require('https-proxy-agent');
 
const agent = new HttpsProxyAgent(process.env.QUOTAGUARDSTATIC_URL);
 
// Only this request exits from your two static IPs
await fetch('https://api.partner.example.com/orders', {
  method: 'POST',
  agent,
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify(payload),
});

In Python, pass proxies on the individual call with the requests library. Calls without that argument continue to use Scalingo's normal egress.

import os, requests
 
proxies = {
    "http": os.environ["QUOTAGUARDSTATIC_URL"],
    "https": os.environ["QUOTAGUARDSTATIC_URL"],
}
 
# Only this request exits from your two static IPs
requests.post("https://api.partner.example.com/orders",
              json=payload, proxies=proxies)

The destination now sees a request from one of your two fixed IPs and can allowlist both once.

Or Set HTTP_PROXY Globally for a Quick Start

If you want every outbound HTTP call to route through the proxy without touching code, set the standard proxy variables and exclude internal hosts. This is faster to set up but coarser, so use it when most of your external calls need the static IP.

scalingo --app your-app env-set HTTP_PROXY="http://username:password@proxy.quotaguard.com:9293"
scalingo --app your-app env-set HTTPS_PROXY="http://username:password@proxy.quotaguard.com:9293"
scalingo --app your-app env-set NO_PROXY=".scalingo.com,localhost,127.0.0.1"
scalingo --app your-app restart

Set NO_PROXY to keep Scalingo addon and internal traffic off the proxy. The risk with the global approach is that any internal host not covered by NO_PROXY gets routed through the proxy too, which is why the in-code pattern above is the safer default.

Verify Your App Is Using the Static IP

After configuring the proxy, make a request to the QuotaGuard IP check endpoint through the same path and confirm the address.

curl -x "$QUOTAGUARDSTATIC_URL" https://ip.quotaguard.com

The response returns the IP your request came from. It should match one of the two static IPs in your QuotaGuard dashboard. Check a few times and you will see both IPs in rotation.

EU Data Residency, and Where It Stops

QuotaGuard supports EU data residency. Running your app through a QuotaGuard EU region in Frankfurt, Ireland, or London keeps outbound traffic exiting from an EU IP, which meets the literal data-residency requirement on shared infrastructure. Enterprise plans give you dedicated EU IPs, and the Data Residency add-on locks all proxy traffic, static IPs, and connection logs to the EU with no cross-border failover, starting at $899 per month. The limit to be clear about: this is EU residency on AWS, not French sovereign-cloud certification. If your obligation is SecNumCloud, QuotaGuard does not meet it, and you should keep that traffic on Scalingo's sovereign egress. See the US and EU data residency page for details.

QuotaGuard Static Pricing Starts at $19/Month

Bandwidth is bundled, with no per-GB overage fees. API calls and partner integrations are low-volume for most apps, so the Starter plan covers a typical workload. Dedicated IPs are available on Enterprise and above. On Starter, Production, and Business, your two assigned IPs are still static, but shared with other customers.

QuotaGuard Shield Pricing Starts at $29/Month

For standard API calls and integrations, Static is the right product. Use QuotaGuard Shield when your app moves regulated data, such as health records, payment information, or sensitive PII, or when your environment requires that no proxy ever decrypts traffic in transit. Shield uses SSL passthrough, so QuotaGuard does not decrypt your payload contents and your TLS keys never leave your servers. It costs slightly more than Static at each tier.

All plans include a 3-day trial. Enterprise plans include a 7-day trial. Credit card required.

See the full pricing table at quotaguard.com/products/pricing.