Vercel Static Outbound IP: Fix GitHub and Prismic Allowlisting Without Paying $100/Month

Add QUOTAGUARDSTATIC_URL to your Vercel project, route blocked outbound requests through QuotaGuard, so the restricted API sees an allowlisted source IP. Allowlist both QuotaGuard addresses and configure the client making the blocked request.

IP Allowlisting Fails Because Vercel's Build IPs Rotate

Vercel runs builds on shared infrastructure with dynamic IP addresses. Without fixed egress configured, the outbound IP can change between builds. If your build process makes outbound HTTP requests (pulling content from Prismic, hitting a GitHub API, fetching from an internal service behind a firewall), the receiving server may see different source IPs.

Services that enforce IP allowlisting will reject requests from unapproved addresses. A GitHub Enterprise Cloud organization with an enabled IP allowlist is one example. A Prismic content request is another if a customer-controlled gateway on its path enforces an IP restriction. Internal APIs with strict firewall rules are a third. The error can look like a timeout, a 403, or a connection refused. The build fails. You redeploy. It fails again.

Confirm an IP-policy rejection with the destination administrator: those errors can also have other causes. Prismic's Content API documentation requires an access token for private repositories; a proxy does not fix a missing token. This Prismic example applies to a confirmed restricted gateway, not a claim that Prismic's standard Content API requires IP allowlisting.

When the destination confirms that changing source IPs are the cause, this isn't a bug in your application logic. It's a consequence of using dynamic egress for an IP-restricted service.

Vercel's Native Solution: Static IPs

Vercel announced Static IPs for Pro and Enterprise on October 2, 2025. The feature assigns shared fixed egress addresses to supported Vercel Function traffic. Build traffic can use them too, but you must separately enable Use Static IPs for builds in the project's Networking settings; it is off by default. Routing Middleware is excluded, and each configured region has its own IP pair. If the blocked request falls within that scope, the native feature can solve the allowlisting problem. See Vercel's current scope and compatibility limits.

The published Pro price is $100/month per project, billed on top of your existing Vercel plan. Static IPs is available on Pro and Enterprise; Enterprise customers should confirm their contract pricing. Hobby plan users cannot enable this add-on. If you're an indie developer on Vercel's free plan, you would need to upgrade before using Vercel Static IPs.

The $100/month is also not the full cost. Vercel charges separately for Private Data Transfer used by traffic routed through your static IPs. The published regional rates are $0.15 to $0.31 per GB; the add-on does not list a bundled transfer allowance.

Here's what the published monthly add-on and transfer charges look like at different usage levels. These USD estimates exclude the underlying Vercel plan, taxes, credits, and negotiated discounts. They assume the stated GB are billable Private Data Transfer on Vercel and fit QuotaGuard's bandwidth metering; check your actual usage on each service.

QuotaGuard plans bundle bandwidth and requests. Starter includes 20,000 requests/month, Production 100,000, and Business 250,000. Both allowances apply across the subscription, not separately to each project. Three projects using 50 GB each need 150 GB in total, so they do not fit Production's 50 GB. Business covers that bandwidth if their combined request count also fits.

QuotaGuard does not list a separate per-GB transfer surcharge for usage within those bundles. Its soft-limit policy accommodates unexpected spikes; sustained excess usage requires right-sizing the plan.

For a single production project at a funded startup, Vercel's $100/month base is probably justifiable if you want zero-code, single-platform setup. For three projects, you're at $300+ per month before data transfer costs. For an agency managing client sites, the math breaks down fast.

One more constraint worth noting: Vercel's Static IPs use a shared VPC model with subnet-level isolation for a small group of customers. This is not dedicated infrastructure, even at $100/month. QuotaGuard's Starter, Production, and Business plans also use shared IP pairs. If you need dedicated IPs, compare Vercel Secure Compute (Enterprise only, custom pricing) with QuotaGuard Static's Enterprise plan ($219/month). Dedicated VPC networking and a dedicated proxy subscription are different products; choose according to the isolation you need.

There's also a platform lock-in consideration. The static IP is tied to Vercel's infrastructure. If you're running any part of your stack on Railway, Render, Fly.io, or a plain EC2 instance, those services need their own solution. Vercel's Static IPs feature does nothing for them.

QuotaGuard Gives Vercel a Fixed Outbound IP for $19/Month

A static IP proxy works differently. Instead of assigning a fixed IP to your entire deployment environment, you route specific outbound requests through a proxy that has a fixed IP. The IP that GitHub or Prismic sees belongs to the proxy, not to Vercel's infrastructure. QuotaGuard supplies a load-balanced pair of static IPs; allowlist both so either can carry your request.

QuotaGuard provides this. Plans start at $19/month with bandwidth included: 10 GB on Starter, 50 GB on Production ($49/month), 200 GB on Business ($89/month). Those prices include the plan's bandwidth and request allowances. The IP pair is shared across customers on Starter, Production, and Business, dedicated on Enterprise. With a compatible proxy client, the same proxy URL works from Vercel, from a Lambda function, from a GitHub Action, from a cron job on a VPS. One subscription, one static IP pair, multiple supported platforms.

Here's what the integration looks like in practice. Follow the Vercel integration guide and set this server-side environment variable to the exact proxy URL from your QuotaGuard dashboard. Select the deployment environments that need it and redeploy after saving. Keep it out of browser code and NEXT_PUBLIC_ variables:

QUOTAGUARDSTATIC_URL=http://username:password@<your-quotaguard-proxy-host>:9293

Then in the code that makes the outbound request (the one that's getting blocked), route it through the proxy. This Node.js ES module example retains https-proxy-agent and explicitly imports node-fetch, which supports the agent option. Node's built-in global fetch uses a different transport API. Install these dependencies in your application (the versions below require Node.js 20 or later):

npm install node-fetch@3.3.2 https-proxy-agent@9.1.0

Replace the example endpoint with your actual protected HTTPS JSON API. This sample uses bearer-token authentication: set RESTRICTED_API_TOKEN server-side, or adapt the headers to your API's documented authentication. Save standalone build code as an .mjs file, or use an application configured for ES modules.

import fetch from 'node-fetch';
import { HttpsProxyAgent } from 'https-proxy-agent';

const proxyUrl = process.env.QUOTAGUARDSTATIC_URL;
const token = process.env.RESTRICTED_API_TOKEN;
if (!proxyUrl || !token) {
  throw new Error('Set QUOTAGUARDSTATIC_URL and RESTRICTED_API_TOKEN.');
}
const agent = new HttpsProxyAgent(proxyUrl);

try {
  const response = await fetch('https://your-restricted-api.example.com/endpoint', {
    agent,
    headers: {
      Accept: 'application/json',
      Authorization: `Bearer ${token}`,
    },
    redirect: 'error',
    signal: AbortSignal.timeout(15_000),
  });
  if (!response.ok) {
    throw new Error(`Protected API returned HTTP ${response.status}`);
  }
  const data = await response.json();
  // Use data in your build or server-side operation.
} finally {
  agent.destroy();
}

The request goes out through QuotaGuard's proxy, and the receiving server sees one of your assigned IPs. Once both addresses are allowlisted and normal API authentication is valid, this resolves the source-IP restriction. The example cleans up its agent after the operation; a long-lived service can reuse an agent and close it during shutdown.

To check routing, make a separate request to https://ip.quotaguard.com using the same imported fetch and agent, without the protected API's authorization header. Compare the returned IP with either dashboard address. Then run the real protected request in the Vercel build or Node.js Function that was failing. A local IP check alone does not verify a deployed build or another SDK's traffic. There is no direct-request fallback in this example.

If you're hitting a GitHub API specifically, the same pattern applies. For GitHub Enterprise Cloud, use https://api.github.com/repos/YOUR_ORG/YOUR_PRIVATE_REPO for a read-only repository request and supply a token authorized for that repository. Add both proxy IPs to the applicable organization or enterprise allowlist. A self-hosted GitHub Enterprise Server uses its own API hostname and network policy. This code routes your API call; it does not reroute Vercel-managed repository cloning before your build code runs.

For a Prismic request through a confirmed IP-restricted gateway, configure the client that sends it. @prismicio/client accepts a custom fetch function, where you can attach a proxy agent to its requests. Retain Prismic's accessToken configuration for a private repository; the bearer header in the generic sample is not Prismic's Content API authentication.

When Vercel's Native Feature Makes More Sense

Be honest about the tradeoffs. Vercel's Static IPs feature is the right call if:

You need fixed IPs across supported Function traffic and optionally enabled build traffic, rather than configuring individual requests. A proxy requires you to explicitly route requests through it. If you're using a third-party SDK that doesn't expose a proxy or custom transport, native routing can avoid changing that client. Check Vercel's compatibility limits for the runtime and feature you use.

You're already on a Vercel Pro plan and you have one or two projects that need this, your bandwidth through the static IP is modest, and the per-project cost fits your budget. The setup is zero-code and you stay entirely within Vercel's ecosystem. That's a reasonable tradeoff.

When a Proxy Makes More Sense

The proxy approach wins when:

You also need inbound fixed IPs. Vercel's Static IPs are outbound only: they do not assign a fixed public IP that external services can use to initiate inbound traffic to your app. If you need a fixed address for incoming webhooks or for clients connecting to your app by IP, Vercel's feature does not cover it. Every QuotaGuard Static and Shield plan includes both an outbound and an inbound proxy. Inbound proxying requires its own setup; the outbound example above does not configure it.

You're managing multiple projects or environments. One QuotaGuard subscription can cover all of them within its combined bandwidth and request allowances. You don't pay per project.

You have services running outside of Vercel. A Railway deployment, a GitHub Action, a local staging environment that needs to hit the same restricted API. Each needs a compatible proxy client, but you hand the same IP pair to your client's IT team regardless of which supported platform you're running on that month.

Your blocked requests are specific and identifiable. You know exactly which outbound calls are failing. Routing those through a proxy is a surgical fix. You're not routing all traffic through a proxy, just the requests that need a fixed IP.

You want to avoid per-project Vercel add-on costs as you scale. $19/month on QuotaGuard's Starter plan can cover multiple projects if their combined traffic stays within 10 GB and 20,000 requests per month. The $49/month Production plan includes 50 GB and 100,000 requests across those projects. For three projects using 50 GB each, choose Business or higher according to combined usage; Business is $89/month versus three Vercel Static IP add-ons at $300/month before transfer.

You're on Vercel's Hobby plan. Vercel's native Static IPs feature requires Pro or Enterprise. To use the add-on from Hobby, you must upgrade first, then pay for Static IPs. QuotaGuard works with compatible server-side code regardless of your Vercel plan. The proxy sits outside Vercel's infrastructure entirely. Vercel's Hobby rules still limit that plan to personal, non-commercial use.

One Setup, Any Platform

The real advantage here is portability. Build infrastructure changes. Teams move from Vercel to Cloudflare Workers or add a backend on Fly.io or run cron jobs on a cheap VPS. Every time you add a platform, the firewall question comes up again. With a compatible proxy transport, the pattern is the same: set the environment variable and route the request. Check runtime support when moving to an edge environment such as Cloudflare Workers rather than assuming this Node.js example transfers unchanged. As long as you retain the same QuotaGuard subscription and assigned pair, the IPs your partners and clients have allowlisted stay the same.

That's worth something operationally. Every IP change triggers a ticket to someone's IT team, a waiting period, a confirmation, a retest. Avoiding that cycle is a real time saving across a year of infrastructure changes.

Fix the Build Failures

If your Vercel builds are failing because of IP allowlisting on GitHub, Prismic, or any other service, the fix is straightforward. Vercel's native Static IPs feature works for supported traffic if you're on Pro or Enterprise and the per-project cost fits your budget. A proxy through QuotaGuard works when your client supports it and you want lower cost, multi-platform coverage, or more surgical control over which requests get a fixed IP.

QuotaGuard Static plans start at $19/month, with a free trial available. Review the options at quotaguard.com/products/pricing, pick the tier that fits your combined bandwidth and request volume, and follow the Vercel setup guide. Setup time depends on your client and the destination's allowlist approval process.

If you handle sensitive data, healthcare records, payment information, or a regulated workload that requires TLS on the application-to-proxy hop, choose QuotaGuard Shield with its supported configuration. Neither Static nor Shield decrypts outbound HTTPS payloads; Shield also encrypts the app-to-proxy hop and provides SSL passthrough for inbound TLS. Shield plans start at $29/month. Review your workload's requirements; choosing a proxy alone does not establish regulatory compliance.

Published prices and product documentation checked October 24, 2026.