QuotaGuard and Zapier Integration Guide

Two ways to use this guide: Setting up the integration yourself? Follow the setup steps below. Working with an AI coding agent? Share this page and use the instructions below to help it configure the integration, verify the connection and troubleshoot issues.

To let your agent set up and test the connection, provide the required proxy connection details through its secure credential mechanism rather than sharing your QuotaGuard account password. Review any changes it proposes.

QuotaGuard Static IPs allow your Zapier workflows to send outbound HTTP requests through a load-balanced pair of static IP addresses. Once configured, you can use QuotaGuard’s IPs to connect to firewalled APIs, enterprise databases, and services that require IP allowlisting.

This integration requires “Code by Zapier” steps. Standard Zap triggers and actions (like Gmail, Slack, or Webhooks by Zapier) cannot be proxied directly. QuotaGuard is specifically for custom code steps that need to reach external services requiring a known, static source IP address.

Why Zaps Get Blocked

Zapier runs on AWS infrastructure, spinning up instances dynamically as needed, and publishes static IP ranges for us-east-1 and us-west-2. Ordinary Zap traffic is not pinned to either range, so your Zap’s outbound requests could originate from a large pool of addresses shared across all Zapier customers.

When your Zap tries to connect to security-conscious partners, you’ll see errors like:

• 403 Forbidden from corporate firewalls and WAFs
• Connection refused from databases with IP allowlisting
• Access denied from banking APIs and payment gateways
• Blocked requests from Google Workspace Context-Aware Access policies

The problem is not your code or API keys. The target service is blocking requests from unknown cloud IP ranges.

QuotaGuard gives your Zaps a fixed, verifiable identity that partners can add to their firewall allowlists once.

Zapier’s Native Static IP Feature

Zapier offers a static IP feature on its Professional, Team, and Enterprise plans. Before using QuotaGuard, you should understand when Zapier’s native feature works and when you need QuotaGuard instead.

When Zapier’s Native Static IP Works

Zapier’s static IP feature only applies to the apps Zapier has enabled for it, and that list now reaches well beyond databases. It currently covers the data warehouses (Snowflake, Google BigQuery, Amazon Redshift, Databricks, Looker), the built-in transfer apps (Webhooks by Zapier, API by Zapier, SFTP by Zapier, SMTP by Zapier, MCP Client by Zapier), and a long list of public apps including Airtable, Salesforce, Stripe, GitHub, GitLab, Microsoft Outlook, QuickBooks Online, WooCommerce, and WordPress. PostgreSQL, MySQL, and SQL Server are supported through separate per-database instructions, and private integrations can be enabled by Zapier Support on request. Zapier keeps the authoritative list in Use a static IP address to connect to Zapier.

Traffic from those apps leaves through Zapier’s own published ranges, which you allowlist as CIDR blocks:

Those ranges are published and shared: every customer using the feature allowlists the same blocks. Read the list as a list of the Zapier apps that make the call, not of the services you are allowed to call. A request sent by Webhooks by Zapier reaches an arbitrary partner API from these ranges on a qualifying plan, because the enabled app is the sender. If you’re on Professional, Team, or Enterprise and the step sending the request belongs to an enabled app, the native feature may be all you need. Code by Zapier is not on that list, so code steps still egress from Zapier’s general IP pool.

When You Need QuotaGuard

You need QuotaGuard when:

• You’re on the Free plan, where Zapier’s static IP feature is not available
• The request leaves from a Code by Zapier step, which Zapier’s static IP feature does not cover
• The step sending the request belongs to an app Zapier has not enabled for static IP
• The destination will not allowlist a shared 16-address block and wants a smaller entry assigned to one subscription
• You need to reach custom APIs or internal services behind a firewall that will not open to a Zapier-wide range
• You need support for HIPAA/PCI requirements (QuotaGuard Shield)
• You need regional data residency (US/EU proxy selection)

What Each Option Costs

Zapier bundles the static IP feature with Professional and above. On Zapier’s pricing page, Professional starts at $19.99/month billed annually ($29.99 billed monthly) for 750 tasks and Team starts at $69.00/month billed annually ($103.50 billed monthly), with Enterprise quoted by their sales team. On QuotaGuard’s pricing page, Static starts at $19/month billed monthly and is independent of your Zapier tier.

Compare the IP allocation carefully, because both products share addresses at their entry tiers. Zapier’s feature routes you through published /28 blocks that every customer on the feature allowlists. QuotaGuard’s Starter, Production, and Business plans assign your subscription a static IP pair that is also shared; a pair reserved for your account alone is an Enterprise feature, $219/month on Static and $269/month on Shield. If a destination’s security review insists on addresses nobody else uses, price Enterprise rather than Starter.

That leaves two decisions:

• Already on Professional or above. The native feature costs you nothing extra, so the choice is about coverage rather than money: which app sends the request, and whether the destination accepts a Zapier-wide block.
• On Free, or paying for a higher Zapier tier only to get a fixed egress IP. QuotaGuard supplies the egress address without moving your whole Zapier account up a tier. Two Zapier plan rules still apply in their own right: declaring packages in a Code step requires a paid plan, and the standard Code step runtime on Free is 1 second, with the full table under Latency Considerations.

No-Code and Webhooks by Zapier Users

The Python Code by Zapier path below is the most direct route, but it requires a small code step. If you are a no-code user, or your Zap relies on Webhooks by Zapier, host a small relay function that egresses through QuotaGuard and point your webhook or HTTP action at it instead. Webhooks by Zapier has no proxy field of its own; on Professional and above its requests do leave from Zapier’s shared static IP ranges, whatever API they are aimed at, so reach for the relay when the destination wants a smaller allowlist entry than a Zapier-wide block. Your Zap calls the relay URL, the relay forwards the request through your two static IPs, and the target API sees a fixed source. QuotaGuard publishes a ready-to-deploy relay at github.com/quotaguard/static-examples, and the pattern is documented in the Static IP Without an HTTP Proxy guide.

Getting Started

After creating a QuotaGuard account, you will be redirected to your dashboard where you can find your proxy credentials and static IP addresses.

Choose the right proxy region: Zapier runs primarily in AWS us-east-1. For lowest latency, select QuotaGuard’s US-East region.

Your proxy URL will look like this:

http://username:password@<your-quotaguard-proxy-host>:9293

This URL contains your credentials and the proxy hostname. You’ll use this to route requests through your static IPs.

Finding Your Static IPs: Your two static IPs are displayed in the QuotaGuard dashboard. Both IPs are active simultaneously for high availability. Add both to any firewall allowlists you’re configuring on the target service side.

Understanding Zapier’s Code Environment

Zapier’s Code by Zapier app provides two language options:

Python Environment

• Python 3.13
• Standard library available
• requests library pre-installed
• BeautifulSoup library available
• No pip install from inside the code, but paid plans can declare public PyPI packages on the step itself

JavaScript Environment

• Node.js 22
• Standard Node.js library available
• Built-in fetch available, and the Zapier SDK is pre-installed
• No npm install from inside the code, but paid plans can declare public npm packages on the step itself

Declaring Packages on Paid Plans

Code steps on the Professional, Team, and Enterprise plans can pull public packages straight from PyPI and npm. In the Code step, open the Packages panel, choose Add new package, enter the case-sensitive package name and an optional version, then save; Zapier copies the matching import statement for you to paste into the editor. The constraints are worth knowing before you design around them:

• JavaScript packages must ship ESM. A package that publishes only CommonJS will not load, and native modules are not supported.
• Adding a package switches the JavaScript editor to the export default async function main() wrapper, which Zapier inserts for you.
• Private registries are not supported, and Zapier does not scan packages for vulnerabilities.
• Installation has its own budget per run: 30 seconds on paid plans, 120 seconds on Enterprise. Memory is 512 MB on every plan.

Important: the built-in fetch takes no proxy argument. That is a property of the Fetch API itself rather than a Zapier limitation. Node added opt-in support for the standard HTTP_PROXY, HTTPS_PROXY, and NO_PROXY variables in 22.21.0 and 24.5.0, but it has to be switched on as the process starts (NODE_USE_ENV_PROXY=1 or --use-env-proxy), and a Code step does not control how its runtime is launched. To proxy from JavaScript, use the raw http and https modules with the HTTP CONNECT method as shown below.

For this reason, Python is the recommended language for proxy integration in Zapier. The requests library is pre-installed and supports proxies natively with a simple configuration.

Python Code Examples (Recommended)

Python is the simplest and most reliable way to route Zapier requests through QuotaGuard. The requests library is pre-installed and supports proxies natively.

Basic Setup

Step 1: In the Zap editor, click + to add a new step.

Step 2: Search for and select Code by Zapier.

Step 3: Select Run Python as the action.

Step 4: In the Input Data section, add your proxy URL as a variable:

• Key: proxy_url
• Value: http://username:password@<your-quotaguard-proxy-host>:9293

Using Input Data keeps your credentials out of the code itself.

Step 5: Add your code in the Code field.

HTTP GET Request

import requests

# Get proxy URL from Input Data
proxy_url = input_data.get('proxy_url')

# Configure proxy
proxies = {
    'http': proxy_url,
    'https': proxy_url
}

# Make the request
response = requests.get(
    'https://api.example.com/data',
    proxies=proxies,
    timeout=25
)

# Return the response
output = {
    'status_code': response.status_code,
    'data': response.json()
}

HTTP POST Request with JSON

import requests
import json

proxy_url = input_data.get('proxy_url')
proxies = {'http': proxy_url, 'https': proxy_url}

# Data to send
payload = {
    'name': input_data.get('name'),
    'email': input_data.get('email'),
    'message': input_data.get('message')
}

response = requests.post(
    'https://api.example.com/submit',
    json=payload,
    proxies=proxies,
    headers={'Content-Type': 'application/json'},
    timeout=25
)

output = {
    'status_code': response.status_code,
    'response': response.json() if response.headers.get('content-type', '').startswith('application/json') else response.text
}

HTTP PUT Request

import requests

proxy_url = input_data.get('proxy_url')
proxies = {'http': proxy_url, 'https': proxy_url}

record_id = input_data.get('record_id')
updated_data = {
    'status': input_data.get('status'),
    'notes': input_data.get('notes')
}

response = requests.put(
    f'https://api.example.com/records/{record_id}',
    json=updated_data,
    proxies=proxies,
    timeout=25
)

output = {
    'status_code': response.status_code,
    'updated': response.status_code == 200
}

Request with Custom Headers and Authentication

import requests

proxy_url = input_data.get('proxy_url')
api_key = input_data.get('api_key')

proxies = {'http': proxy_url, 'https': proxy_url}

headers = {
    'Authorization': f'Bearer {api_key}',
    'Content-Type': 'application/json',
    'X-Custom-Header': 'Zapier-Integration'
}

response = requests.get(
    'https://api.example.com/protected-endpoint',
    headers=headers,
    proxies=proxies,
    timeout=25
)

output = {
    'status_code': response.status_code,
    'data': response.json()
}

Error Handling

import requests

proxy_url = input_data.get('proxy_url')
proxies = {'http': proxy_url, 'https': proxy_url}

try:
    response = requests.get(
        input_data.get('target_url'),
        proxies=proxies,
        timeout=25
    )
    response.raise_for_status()
    
    output = {
        'success': True,
        'status_code': response.status_code,
        'data': response.json() if 'application/json' in response.headers.get('content-type', '') else response.text
    }
    
except requests.exceptions.Timeout:
    output = {
        'success': False,
        'error': 'Request timed out',
        'error_type': 'timeout'
    }
    
except requests.exceptions.HTTPError as e:
    output = {
        'success': False,
        'error': str(e),
        'error_type': 'http_error',
        'status_code': e.response.status_code if e.response else None
    }
    
except requests.exceptions.RequestException as e:
    output = {
        'success': False,
        'error': str(e),
        'error_type': 'request_error'
    }

JavaScript Code Examples

JavaScript proxy support in Zapier is more involved because the built-in fetch does not accept a proxy. The examples below use the native http and https modules with the HTTP CONNECT method, so there are no packages to declare.

On a paid plan you can instead declare a proxy-aware npm package in the step’s Packages panel, provided it ships an ESM build and contains no native modules. Check both before committing to one, and keep the native-module approach below as your fallback.

Note: If possible, use Python instead. The Python approach is simpler and more reliable.

Basic HTTP GET with Proxy (Native http/https)

const http = require('http');
const https = require('https');
const { URL } = require('url');

// Parse proxy URL from Input Data
const proxyUrl = new URL(inputData.proxy_url);
const targetUrl = new URL(inputData.target_url || 'https://ip.quotaguard.com');

// Create proxy authorization header
const proxyAuth = 'Basic ' + Buffer.from(
    proxyUrl.username + ':' + proxyUrl.password
).toString('base64');

// Use HTTP CONNECT method to tunnel through proxy
const tunnelReq = http.request({
    host: proxyUrl.hostname,
    port: proxyUrl.port || 9293,
    method: 'CONNECT',
    path: `${targetUrl.hostname}:443`,
    headers: {
        'Proxy-Authorization': proxyAuth
    }
});

return new Promise((resolve, reject) => {
    tunnelReq.on('connect', (res, socket) => {
        if (res.statusCode !== 200) {
            reject(new Error(`Proxy connection failed: ${res.statusCode}`));
            return;
        }
        
        // Create HTTPS agent using the tunneled socket
        const agent = new https.Agent({ socket });
        
        const req = https.get({
            hostname: targetUrl.hostname,
            path: targetUrl.pathname + targetUrl.search,
            agent: agent,
            headers: {
                'Host': targetUrl.hostname
            }
        }, (response) => {
            let data = '';
            response.on('data', chunk => data += chunk);
            response.on('end', () => {
                try {
                    resolve({
                        status_code: response.statusCode,
                        data: JSON.parse(data)
                    });
                } catch {
                    resolve({
                        status_code: response.statusCode,
                        data: data
                    });
                }
            });
        });
        
        req.on('error', reject);
    });
    
    tunnelReq.on('error', reject);
    tunnelReq.end();
});

Simplified JavaScript Helper Function

const http = require('http');
const https = require('https');
const { URL } = require('url');

async function fetchThroughProxy(targetUrl, proxyUrl, options = {}) {
    const proxy = new URL(proxyUrl);
    const target = new URL(targetUrl);
    
    const proxyAuth = 'Basic ' + Buffer.from(
        proxy.username + ':' + proxy.password
    ).toString('base64');
    
    return new Promise((resolve, reject) => {
        const tunnelReq = http.request({
            host: proxy.hostname,
            port: proxy.port || 9293,
            method: 'CONNECT',
            path: `${target.hostname}:443`,
            headers: { 'Proxy-Authorization': proxyAuth }
        });
        
        tunnelReq.on('connect', (res, socket) => {
            if (res.statusCode !== 200) {
                reject(new Error(`Proxy failed: ${res.statusCode}`));
                return;
            }
            
            const agent = new https.Agent({ socket });
            const method = (options.method || 'GET').toUpperCase();
            
            const reqOptions = {
                hostname: target.hostname,
                path: target.pathname + target.search,
                method: method,
                agent: agent,
                headers: {
                    'Host': target.hostname,
                    ...options.headers
                }
            };
            
            const req = https.request(reqOptions, (response) => {
                let data = '';
                response.on('data', chunk => data += chunk);
                response.on('end', () => {
                    resolve({
                        status: response.statusCode,
                        headers: response.headers,
                        body: data
                    });
                });
            });
            
            req.on('error', reject);
            
            if (options.body) {
                req.write(options.body);
            }
            req.end();
        });
        
        tunnelReq.on('error', reject);
        tunnelReq.end();
    });
}

// Usage
const result = await fetchThroughProxy(
    inputData.target_url,
    inputData.proxy_url
);

output = {
    status_code: result.status,
    data: result.body
};

Inbound Webhooks (Reverse Proxy)

If a secure partner needs to send data TO your Zap but requires a static destination IP to open their firewall, QuotaGuard can help with inbound traffic too.

How Inbound Proxy Works

1. Open your QuotaGuard dashboard
2. Navigate to Setup > Inbound
3. Enter your Zapier Webhook URL (e.g., https://hooks.zapier.com/hooks/catch/12345/abcdef)
4. QuotaGuard generates a unique URL like a62b1d0b4983db763450411fd393b3ce-us-east-1.getstatica.com

Your partner sends requests to this QuotaGuard URL, which resolves to your static IPs. QuotaGuard then forwards the traffic to your actual Zapier webhook.

Use Case

A financial institution needs to send transaction data to your Zap but only allows outbound traffic to whitelisted IP addresses. They can whitelist your QuotaGuard static IPs, send data to your QuotaGuard inbound URL, and you receive it in your standard Webhooks by Zapier trigger.

Database Connections (SOCKS5)

For non-HTTP protocols like PostgreSQL, MySQL, or MongoDB, use QuotaGuard’s SOCKS5 proxy on port 1080.

Limitations in Zapier

Zapier Code steps are ephemeral (serverless). Each execution starts fresh with no persistent connections. This creates challenges for database connections:

1. Connection must open, execute, and close within Zapier’s timeout limits
2. Connection pooling is not possible
3. No keep-alive connections between Zap runs

Python Database Example

Python’s SOCKS5 support comes from PySocks, installed as requests[socks]. It is not pre-installed, but on a paid plan you can declare it in the step’s Packages panel, so library availability is no longer the obstacle it once was.

What has not changed is the shape of the environment. A Code step is a short-lived sandbox with a per-plan runtime budget, no connection pooling, and no sockets kept open between runs, and Zapier’s Code documentation covers HTTP requests rather than raw outbound TCP. The alternatives below keep database access on HTTP, which is what the Code environment is documented to do.

For database access from Zapier, consider these alternatives:

1. API Wrapper: Create a simple API endpoint (using AWS Lambda, Google Cloud Functions, or a small server) that accepts HTTP requests and queries your database. Route the HTTP request through QuotaGuard.

2. Self-hosted automation: For complex database workflows, consider a self-hosted automation platform like n8n where you have full control over the environment.

3. Database HTTP APIs: Some databases offer HTTP/REST APIs (Supabase via PostgREST, Firebase, Neon’s SQL-over-HTTP, and similar) that you can reach through the HTTP proxy. MongoDB’s Atlas Data API is no longer one of them: it reached end of life on 30 September 2025.

Example: Using a Database via HTTP API

If your database provider offers an HTTP API:

import requests

proxy_url = input_data.get('proxy_url')
db_api_key = input_data.get('db_api_key')

proxies = {'http': proxy_url, 'https': proxy_url}

# Example: Supabase, which exposes PostgreSQL over PostgREST
response = requests.get(
    'https://your-project.supabase.co/rest/v1/users',
    params={'select': '*', 'status': 'eq.active'},
    headers={
        'apikey': db_api_key,
        'Accept': 'application/json'
    },
    proxies=proxies,
    timeout=25
)
response.raise_for_status()

output = {
    'rows': response.json()
}

Supabase’s publishable and secret keys are short strings rather than JWTs, and they belong on the apikey header. Add Authorization: Bearer <token> only when the request acts as a signed-in user and you have that user’s own JWT. Postgres checks grants before Row Level Security. The role needs SELECT access to the queried data. With RLS enabled, anon and authenticated roles also need a matching SELECT policy; secret keys use service_role and bypass RLS. Missing grants return a permission error; an RLS policy matching no rows returns an empty list.

The same shape works for any database with an HTTP front end: swap the URL, the authentication headers, and the query parameters, and keep the proxies argument so the request leaves from your static IPs.

Testing Your Implementation

Create a simple test Zap to verify your proxy configuration:

Test Zap Structure

1. Trigger: Manual trigger (or any trigger you want)
2. Action: Code by Zapier (Run Python)

Test Code

Add a second Input Data field alongside proxy_url for this test:

• Key: expected_ips
• Value: both IPs from your QuotaGuard dashboard, comma-separated

import requests

proxy_url = input_data.get('proxy_url')
expected_ips = [ip.strip() for ip in input_data.get('expected_ips', '').split(',') if ip.strip()]

proxies = {'http': proxy_url, 'https': proxy_url}

response = requests.get(
    'https://ip.quotaguard.com',
    proxies=proxies,
    timeout=25
)

observed_ip = response.json().get('ip')

output = {
    'your_static_ip': observed_ip,
    'expected_ips': expected_ips,
    'proxy_working': observed_ip in expected_ips
}

proxy_working is the comparison itself rather than a constant, so the step tells you whether the request really left from one of your addresses. Fill expected_ips from the dashboard; the values below are only placeholders.

Expected Response

{
    "your_static_ip": "52.34.188.175",
    "expected_ips": ["52.34.188.175", "52.34.188.176"],
    "proxy_working": true
}

The returned IP must match either of your two assigned IPs shown in the QuotaGuard dashboard. You can repeat the Zap, but observing both addresses is not required for success. Allowlist both assigned IPs at the destination.

Keeping Credentials Secure

Do not hard-code your QuotaGuard credentials in the Code field. Use Zapier’s Input Data feature instead.

Recommended Setup

1. In your Code step, add Input Data fields:

   • Key: proxy_url

     Value: Your full QuotaGuard URL

   • Key: api_key

     Value: Any API keys for your target service

2. Reference these in your code:

   proxy_url = input_data.get('proxy_url')
   api_key = input_data.get('api_key')
   

This keeps credentials:

• Visible only to Zap editors
• Out of the code logic
• Easier to update without modifying code

Latency Considerations

Using QuotaGuard adds a network hop to your requests:

Zapier Code steps have strict runtime limits. QuotaGuard’s latency is well within them and is typically not the bottleneck; the cold-start time of a Code step usually adds more delay than the proxy connection.

Those runtime limits depend on your plan:

Professional, Team, and Enterprise can also request an extended runtime of up to 10 minutes, which applies to Code actions only, not Code triggers. Memory is 512 MB on every plan.

For production Zaps, always include a timeout in your requests and keep it inside your plan’s limit. The timeout=25 used in the examples above leaves a little headroom on Professional’s and Team’s 30 seconds. On Free the whole step has 1 second, so set the request timeout inside that budget.

Troubleshooting

407 Proxy Authentication Required

Your proxy credentials are incorrect. Verify:

1. Username and password in the proxy URL
2. The URL format is correct: http://username:password@hostname:9293
3. You’re using the correct QuotaGuard product (Static vs Shield)

Connection Timeout

1. Ensure the target URL is correct and accessible
2. Add explicit timeout to your requests: timeout=25
3. Check if the target service has additional firewall rules
4. Verify QuotaGuard proxy hostname is correct

403 Forbidden (Still Getting Blocked)

After configuring the proxy, if you still see 403 errors:

1. Verify the proxy is working by testing with ip.quotaguard.com
2. Confirm both QuotaGuard IPs are added to the target service’s allowlist
3. Check if the target service requires additional headers or authentication
4. Some services block by user-agent. Try adding a custom user-agent header.

Code Step Errors

“Process exited before completing request”

Your code is not returning properly. For Python, ensure you’re setting output. For JavaScript with async code, ensure you’re using await or properly handling Promises.

“Scripting payload too large”

The response data exceeds Zapier’s limits. Filter or limit the response data before returning.

Python Import Errors

If you see ModuleNotFoundError, the library is not in the step’s environment. The standard library, requests, and BeautifulSoup are present by default; anything else has to be declared in the step’s Packages panel, which requires a paid plan. Package names are case-sensitive, so check the spelling and capitalization against PyPI.

JavaScript Proxy Not Working

If using JavaScript and the proxy isn’t working:

1. The built-in fetch takes no proxy argument, and Node’s environment-variable proxy support has to be enabled as the process starts, which a Code step does not control. See Understanding Zapier’s Code Environment for the versions involved, and use the http/https modules with the CONNECT method as shown above.
2. If you declared an npm package to handle the proxy, confirm it ships an ESM build. CommonJS-only packages and native modules do not load in Code steps.
3. Consider switching to Python, which has simpler proxy support.

QuotaGuard Static vs QuotaGuard Shield

QuotaGuard offers two products for static IPs:

For most Zapier workflows, QuotaGuard Static provides everything you need. Choose Shield if you’re handling protected health information (PHI), payment card data, or have specific compliance requirements.

Ready to Get Started?

Get in touch or create a free trial account.

Get QuotaGuard for Zapier

View Zapier Integration Features

Contact Engineering Support