QuotaGuard and Replit Integration Guide

QuotaGuard and Replit Integration Guide

QuotaGuard gives your Replit app two fixed outbound IP addresses. Add your QuotaGuard connection URL as a Secret, route HTTP and HTTPS traffic through it, use QGTunnel for raw TCP databases, and register your two static IPs with the destination once. Every deploy then leaves from the same two addresses. This guide covers the Secret setup, per-language configuration, QGTunnel for databases, the Replit deployment types this applies to, testing, and troubleshooting.

Why Replit Apps Need a Static IP

Replit runs your app in a container on Google Cloud and assigns a fresh outbound IP on every deploy and restart. There is no platform setting to reserve a fixed one. This is normal for ephemeral cloud infrastructure, and it does not matter until you connect to something that allowlists by IP.

These are the connections that break when the IP rotates:

• External databases behind a firewall or security group (PostgreSQL on RDS, MongoDB Atlas, a publicly accessible Redshift cluster)
• Partner and enterprise APIs that restrict access by source IP
• Payment providers and banking APIs that require a registered IP (Stripe Connect, Adyen)
• AI agent workflows where Replit Agent calls protected APIs or enterprise data sources
• Any internal API behind a firewall your organization controls

When the IP changes, the destination silently rejects the request. You see a timeout, a 403, or a generic auth error, and the cause is which IP the request came from. Two static IPs fix it: you allowlist the pair once and they stay valid across every deploy.

Getting Started

After creating a QuotaGuard account, you are redirected to your dashboard, where you can find your proxy credentials and two static IP addresses.

Choose the right proxy region: Select the QuotaGuard region closest to the service your Replit app talks to, to minimize latency. The region is set at sign-up. Changes after sign-up require contacting support.

Deployment types: This guide applies to Autoscale and Reserved VM deployments, which run backend code and support Secrets. Static deployments serve frontend files only, have no Secrets, and make no outbound calls, so a static IP does not apply to them.

Step 1: Add the Proxy URL as a Secret

In your Replit project, open the Secrets panel under Tools, the lock icon in the sidebar. Add your QuotaGuard connection URL. This keeps the credential out of your code and out of version control.

QUOTAGUARDSTATIC_URL=http://username:password@<your-quotaguard-proxy-host>:9293

Use the exact value from your QuotaGuard dashboard. The HTTP/HTTPS port is 9293.

Replit Secrets are available as environment variables at runtime in both dev mode and production deployments.

Step 2: Route HTTP and HTTPS Traffic

How you apply the proxy depends on your language and what you are connecting to.

Python

With requests:

import os
import requests

proxy_url = os.environ['QUOTAGUARDSTATIC_URL']
proxies = {'http': proxy_url, 'https': proxy_url}

response = requests.get('https://api.example.com/data', proxies=proxies)
print(response.json())

With HTTPX (sync and async):

import os
import httpx

proxy_url = os.environ['QUOTAGUARDSTATIC_URL']

# Sync
with httpx.Client(proxy=proxy_url) as client:
    response = client.get('https://api.example.com/data')

# Async
async with httpx.AsyncClient(proxy=proxy_url) as client:
    response = await client.get('https://api.example.com/data')

With aiohttp (async):

import os
import aiohttp

proxy_url = os.environ['QUOTAGUARDSTATIC_URL']

async with aiohttp.ClientSession() as session:
    async with session.get('https://api.example.com/data', proxy=proxy_url) as response:
        data = await response.json()

Node.js

Node’s native fetch does not read proxy environment variables on its own. Pass the Secret into a proxy agent.

With undici (built-in HTTP stack):

import { ProxyAgent, fetch } from 'undici';

const dispatcher = new ProxyAgent(process.env.QUOTAGUARDSTATIC_URL);

const response = await fetch('https://api.example.com/data', { dispatcher });
const data = await response.json();

With Axios:

const axios = require('axios');
const { HttpsProxyAgent } = require('https-proxy-agent');

const agent = new HttpsProxyAgent(process.env.QUOTAGUARDSTATIC_URL);

const response = await axios.get('https://api.example.com/data', { httpsAgent: agent });
console.log(response.data);

With node-fetch:

const fetch = require('node-fetch');
const { HttpsProxyAgent } = require('https-proxy-agent');

const agent = new HttpsProxyAgent(process.env.QUOTAGUARDSTATIC_URL);

const response = await fetch('https://api.example.com/data', { agent });
const data = await response.json();

Ruby

With Net::HTTP:

require 'net/http'
require 'uri'

proxy_uri = URI.parse(ENV['QUOTAGUARDSTATIC_URL'])

http = Net::HTTP.new(
  'api.example.com',
  443,
  proxy_uri.host,
  proxy_uri.port,
  proxy_uri.user,
  proxy_uri.password
)
http.use_ssl = true

response = http.get('/data')
puts response.body

With Faraday:

require 'faraday'

conn = Faraday.new(proxy: ENV['QUOTAGUARDSTATIC_URL']) do |f|
  f.request :json
  f.response :json
end

response = conn.get('https://api.example.com/data')

Go

package main

import (
    "fmt"
    "net/http"
    "net/url"
    "os"
)

func main() {
    proxyURL, _ := url.Parse(os.Getenv("QUOTAGUARDSTATIC_URL"))

    client := &http.Client{
        Transport: &http.Transport{
            Proxy: http.ProxyURL(proxyURL),
        },
    }

    resp, err := client.Get("https://api.example.com/data")
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    fmt.Println("Status:", resp.Status)
}

PHP

With cURL:

<?php

$proxyUrl = getenv('QUOTAGUARDSTATIC_URL');
$proxy = parse_url($proxyUrl);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'https://api.example.com/data');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_PROXY, $proxy['host'] . ':' . $proxy['port']);
curl_setopt($ch, CURLOPT_PROXYUSERPWD, $proxy['user'] . ':' . $proxy['pass']);

$response = curl_exec($ch);
curl_close($ch);
print_r(json_decode($response, true));

With Guzzle:

use GuzzleHttp\Client;

$client = new Client([
    'proxy' => getenv('QUOTAGUARDSTATIC_URL')
]);

$response = $client->get('https://api.example.com/data');

Java (OkHttp)

import okhttp3.*;
import java.net.*;

public class ProxiedClient {
    public static OkHttpClient createClient() throws Exception {
        String proxyUrlStr = System.getenv("QUOTAGUARDSTATIC_URL");
        URL proxyUrl = new URL(proxyUrlStr);

        String[] userInfo = proxyUrl.getUserInfo().split(":");

        Proxy proxy = new Proxy(Proxy.Type.HTTP,
            new InetSocketAddress(proxyUrl.getHost(), proxyUrl.getPort()));

        Authenticator proxyAuth = (route, response) -> {
            String credential = Credentials.basic(userInfo[0], userInfo[1]);
            return response.request().newBuilder()
                .header("Proxy-Authorization", credential)
                .build();
        };

        return new OkHttpClient.Builder()
            .proxy(proxy)
            .proxyAuthenticator(proxyAuth)
            .build();
    }
}

C# / .NET

var proxyUrl = Environment.GetEnvironmentVariable("QUOTAGUARDSTATIC_URL");
var proxyUri = new Uri(proxyUrl);

var proxy = new WebProxy(proxyUri.GetLeftPart(UriPartial.Authority))
{
    Credentials = new NetworkCredential(
        Uri.UnescapeDataString(proxyUri.UserInfo.Split(':')[0]),
        Uri.UnescapeDataString(proxyUri.UserInfo.Split(':')[1])
    )
};

var handler = new HttpClientHandler { Proxy = proxy, UseProxy = true };
var client = new HttpClient(handler);

var response = await client.GetAsync("https://api.example.com/data");

Step 3: Route Databases With QGTunnel

For raw TCP connections to PostgreSQL, MySQL, or MongoDB, an HTTP proxy is not enough. Use QGTunnel, which routes the connection through your static IPs over SOCKS5. Download it into the root of your project.

curl https://s3.amazonaws.com/quotaguard/qgtunnel-latest.tar.gz | tar xz

This creates bin/qgtunnel and vendor/nss_wrapper/. In your QuotaGuard dashboard, go to Setup > QGTunnel Configuration > Create a Tunnel, and point it at your database host and port.

Leave Encrypted off if your database protocol is already encrypted, which Postgres and most managed databases are. Then prepend your run command with bin/qgtunnel. With transparent mode and matching ports, your code connects to the normal database hostname and needs no change. Allowlist your two static IPs in the database firewall or security group once.

If you prefer to configure SOCKS5 directly in your driver, the SOCKS5 endpoint is on port 1080 on the same proxy host.

Selective Proxying

Only route requests that need static IPs through the proxy. This minimizes latency for requests to public APIs while ensuring protected services always receive requests from your allowlisted addresses.

const axios = require('axios');
const { HttpsProxyAgent } = require('https-proxy-agent');

const proxyAgent = new HttpsProxyAgent(process.env.QUOTAGUARDSTATIC_URL);

// Only these domains route through the static IP proxy
const PROTECTED_DOMAINS = [
    'api.paymentprovider.com',
    'api.partner.com',
    'your-db-host.amazonaws.com'
];

function needsStaticIP(url) {
    const hostname = new URL(url).hostname;
    return PROTECTED_DOMAINS.some(domain => hostname.includes(domain));
}

async function smartRequest(url, options = {}) {
    const config = { ...options };
    if (needsStaticIP(url)) {
        config.httpsAgent = proxyAgent;
    }
    return axios(url, config);
}

Testing the Connection

Confirm your traffic leaves from a QuotaGuard static IP. Route a request to the IP check endpoint and read the response.

import os, requests
proxies = {"http": os.environ["QUOTAGUARDSTATIC_URL"], "https": os.environ["QUOTAGUARDSTATIC_URL"]}
print(requests.get("https://ip.quotaguard.com", proxies=proxies).json())

{"ip":"<one of your two QuotaGuard static IPs>"}

The returned IP must be one of the two static IPs in your dashboard. Call it more than once and you will see both addresses, because the pair is load-balanced. Add both to your destination’s allowlist.

Outbound and Inbound

Outbound is the main case for Replit. Your app calls out to a database or API, and the destination checks the source IP. Everything above covers this direction.

Inbound applies when a partner or enterprise system needs to reach your Replit app from a known address. QuotaGuard includes inbound proxy on all direct plans (Starter and above), and QuotaGuard Shield covers the inbound path when that incoming traffic is regulated.

Troubleshooting

The request still comes from a Replit IP, not a QuotaGuard IP The client is not using the proxy. For Node’s fetch, confirm the https-proxy-agent or undici dispatcher is attached to the request. For requests, confirm the proxies argument is passed. Check the Secret is set in the deployment, not only in the editor.

Connection times out to a database HTTP proxy settings do not cover raw TCP databases. Use QGTunnel for PostgreSQL, MySQL, or MongoDB, and confirm the tunnel’s remote host and port match your database.

407 Proxy Authentication Required The proxy credentials are wrong. Recheck the username and password in your QUOTAGUARDSTATIC_URL Secret against the dashboard. A credential with a special character may need URL-encoding.

It works in the editor but not in the deployment Secrets set in the editor are not always present in a deployment. Confirm the Secret exists for the deployed app, then redeploy.

Static deployment has no Secrets panel Static deployments serve frontend files only and do not support Secrets or backend code. Use an Autoscale or Reserved VM deployment for any app that makes outbound calls.

SSL/TLS errors in Node.js Make sure you are using httpsAgent (not httpAgent) for HTTPS requests when configuring Axios or similar clients.

QuotaGuard Static vs QuotaGuard Shield

Static is right for most Replit apps. Choose Shield if the workload handles regulated data or your environment requires TLS between your app and the proxy itself.

Ready to Get Started?

Get in touch or create a free trial account.

Try QuotaGuard Now

Contact Support </content> </invoke>