QuotaGuard and Replit Integration Guide

QuotaGuard gives selected outbound connections from your Replit backend two fixed IP addresses. Add the QuotaGuard connection URL as a Secret, explicitly configure the HTTP clients that need it, use QGTunnel for raw TCP databases, and register both static IPs with the destination once. Those routed connections then keep the same outbound identity across deployments. This guide covers Secret setup, per-language configuration, QGTunnel for databases, supported Replit deployment types, testing, and troubleshooting.

Why Replit Apps Need a Static IP

Replit advertises native static outbound IPs on its custom-priced Enterprise plan. Its public documentation does not define the deployment coverage, number of IPs, exclusivity, or routing behavior of that feature. QuotaGuard is the self-service alternative when you need two stable addresses without moving the organization to Replit Enterprise, want to route only selected destinations, or want an outbound identity that is portable beyond Replit.

On Replit plans without a documented static-egress feature, do not treat an observed outbound address as permanent. Dynamic cloud infrastructure can change the address used by a deployment, which becomes a problem when a destination allowlists callers by source IP.

These are the connections that break when the IP rotates:

• External databases behind a firewall or security group (PostgreSQL on RDS, MongoDB Atlas, a publicly accessible Redshift cluster)
• Partner and enterprise APIs that restrict access by source IP
• Payment providers and banking APIs that require a registered IP (Stripe Connect, Adyen)
• AI agent workflows where Replit Agent calls protected APIs or enterprise data sources
• Any internal API behind a firewall your organization controls

When the source IP changes, the destination can reject the request. You may see a timeout, a 403, or a generic authentication error. Routing the connection through QuotaGuard gives the destination a stable pair to allowlist while QuotaGuard operates the proxy infrastructure, availability, monitoring, and failover.

Getting Started

After creating a QuotaGuard account, you are redirected to your dashboard, where you can find your proxy credentials and two static IP addresses.

Choose the right proxy region: Select the QuotaGuard region closest to the service your Replit app talks to, to minimize latency. The region is set at sign-up. Changes after sign-up require contacting support.

Deployment types: This guide applies to backend workloads such as Autoscale, Reserved VM, and Scheduled deployments. Static deployments serve frontend files and have no backend runtime. Replit can expose deployment secrets to a static site’s build command, but browser traffic after publication does not gain a server-side outbound identity. Replit Agent’s full-stack applications use Autoscale or Reserved VM deployments rather than Static deployments.

Step 1: Add the Proxy URL as a Secret

In your Replit project, open the Secrets panel under Tools, the lock icon in the sidebar. Add your QuotaGuard connection URL. This keeps the credential out of your code and out of version control.

QUOTAGUARDSTATIC_URL=http://username:password@<your-quotaguard-proxy-host>:9293

Use the exact value from your QuotaGuard dashboard. The HTTP/HTTPS port is 9293.

Replit Secrets are available as environment variables at runtime in both development and production deployments. A Secret stores the credential; it does not automatically proxy every outbound request. Configure each HTTP client that needs the static route, or use QGTunnel for the supported TCP connection.

Step 2: Route HTTP and HTTPS Traffic

How you apply the proxy depends on your language and what you are connecting to.

Python

With requests:

import os
import requests

proxy_url = os.environ['QUOTAGUARDSTATIC_URL']
proxies = {'http': proxy_url, 'https': proxy_url}

response = requests.get('https://api.example.com/data', proxies=proxies)
print(response.json())

With HTTPX (sync and async):

import os
import httpx

proxy_url = os.environ['QUOTAGUARDSTATIC_URL']

# Sync
with httpx.Client(proxy=proxy_url) as client:
    response = client.get('https://api.example.com/data')

# Async
async with httpx.AsyncClient(proxy=proxy_url) as client:
    response = await client.get('https://api.example.com/data')

With aiohttp (async):

import os
import aiohttp

proxy_url = os.environ['QUOTAGUARDSTATIC_URL']

async with aiohttp.ClientSession() as session:
    async with session.get('https://api.example.com/data', proxy=proxy_url) as response:
        data = await response.json()

Node.js

Node’s native fetch does not read proxy environment variables on its own. Pass the Secret into a proxy agent.

With undici (built-in HTTP stack):

import { ProxyAgent, fetch } from 'undici';

const dispatcher = new ProxyAgent(process.env.QUOTAGUARDSTATIC_URL);

const response = await fetch('https://api.example.com/data', { dispatcher });
const data = await response.json();

With Axios:

const axios = require('axios');
const { HttpsProxyAgent } = require('https-proxy-agent');

const agent = new HttpsProxyAgent(process.env.QUOTAGUARDSTATIC_URL);

const response = await axios.get('https://api.example.com/data', { httpsAgent: agent });
console.log(response.data);

With node-fetch:

const fetch = require('node-fetch');
const { HttpsProxyAgent } = require('https-proxy-agent');

const agent = new HttpsProxyAgent(process.env.QUOTAGUARDSTATIC_URL);

const response = await fetch('https://api.example.com/data', { agent });
const data = await response.json();

Ruby

With Net::HTTP:

require 'net/http'
require 'uri'

proxy_uri = URI.parse(ENV['QUOTAGUARDSTATIC_URL'])

http = Net::HTTP.new(
  'api.example.com',
  443,
  proxy_uri.host,
  proxy_uri.port,
  proxy_uri.user,
  proxy_uri.password
)
http.use_ssl = true

response = http.get('/data')
puts response.body

With Faraday:

require 'faraday'

conn = Faraday.new(proxy: ENV['QUOTAGUARDSTATIC_URL']) do |f|
  f.request :json
  f.response :json
end

response = conn.get('https://api.example.com/data')

Go

package main

import (
    "fmt"
    "net/http"
    "net/url"
    "os"
)

func main() {
    proxyURL, _ := url.Parse(os.Getenv("QUOTAGUARDSTATIC_URL"))

    client := &http.Client{
        Transport: &http.Transport{
            Proxy: http.ProxyURL(proxyURL),
        },
    }

    resp, err := client.Get("https://api.example.com/data")
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    fmt.Println("Status:", resp.Status)
}

PHP

With cURL:

<?php

$proxyUrl = getenv('QUOTAGUARDSTATIC_URL');
$proxy = parse_url($proxyUrl);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'https://api.example.com/data');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_PROXY, $proxy['host'] . ':' . $proxy['port']);
curl_setopt($ch, CURLOPT_PROXYUSERPWD, $proxy['user'] . ':' . $proxy['pass']);

$response = curl_exec($ch);
curl_close($ch);
print_r(json_decode($response, true));

With Guzzle:

use GuzzleHttp\Client;

$client = new Client([
    'proxy' => getenv('QUOTAGUARDSTATIC_URL')
]);

$response = $client->get('https://api.example.com/data');

Java (OkHttp)

import okhttp3.*;
import java.net.*;

public class ProxiedClient {
    public static OkHttpClient createClient() throws Exception {
        String proxyUrlStr = System.getenv("QUOTAGUARDSTATIC_URL");
        URL proxyUrl = new URL(proxyUrlStr);

        String[] userInfo = proxyUrl.getUserInfo().split(":");

        Proxy proxy = new Proxy(Proxy.Type.HTTP,
            new InetSocketAddress(proxyUrl.getHost(), proxyUrl.getPort()));

        Authenticator proxyAuth = (route, response) -> {
            String credential = Credentials.basic(userInfo[0], userInfo[1]);
            return response.request().newBuilder()
                .header("Proxy-Authorization", credential)
                .build();
        };

        return new OkHttpClient.Builder()
            .proxy(proxy)
            .proxyAuthenticator(proxyAuth)
            .build();
    }
}

C# / .NET

var proxyUrl = Environment.GetEnvironmentVariable("QUOTAGUARDSTATIC_URL");
var proxyUri = new Uri(proxyUrl);

var proxy = new WebProxy(proxyUri.GetLeftPart(UriPartial.Authority))
{
    Credentials = new NetworkCredential(
        Uri.UnescapeDataString(proxyUri.UserInfo.Split(':')[0]),
        Uri.UnescapeDataString(proxyUri.UserInfo.Split(':')[1])
    )
};

var handler = new HttpClientHandler { Proxy = proxy, UseProxy = true };
var client = new HttpClient(handler);

var response = await client.GetAsync("https://api.example.com/data");

Step 3: Route Databases With QGTunnel

For raw TCP connections to PostgreSQL, MySQL, or MongoDB, an HTTP proxy is not enough. Use QGTunnel, which routes the connection through your static IPs over SOCKS5. Download it into the root of your project.

curl https://s3.amazonaws.com/quotaguard/qgtunnel-latest.tar.gz | tar xz

This creates bin/qgtunnel and vendor/nss_wrapper/. In your QuotaGuard dashboard, go to Setup > QGTunnel Configuration > Create a Tunnel, and point it at your database host and port.

Leave Encrypted off if your database protocol is already encrypted, which Postgres and most managed databases are. Then prepend your run command with bin/qgtunnel. With transparent mode and matching ports, your code connects to the normal database hostname and needs no change. Allowlist your two static IPs in the database firewall or security group once.

If you prefer to configure SOCKS5 directly in your driver, the SOCKS5 endpoint is on port 1080 on the same proxy host.

Selective Proxying

Only route requests that need static IPs through the proxy. This minimizes latency for requests to public APIs while ensuring protected services always receive requests from your allowlisted addresses.

const axios = require('axios');
const { HttpsProxyAgent } = require('https-proxy-agent');

const proxyAgent = new HttpsProxyAgent(process.env.QUOTAGUARDSTATIC_URL);

// Only these domains route through the static IP proxy
const PROTECTED_DOMAINS = [
    'api.paymentprovider.com',
    'api.partner.com'
];

function needsStaticIP(url) {
    const hostname = new URL(url).hostname.toLowerCase();
    return PROTECTED_DOMAINS.some(domain =>
        hostname === domain || hostname.endsWith(`.${domain}`)
    );
}

async function smartRequest(url, options = {}) {
    const config = { ...options };
    if (needsStaticIP(url)) {
        config.httpsAgent = proxyAgent;
    }
    return axios(url, config);
}

Testing the Connection

Confirm your traffic leaves from a QuotaGuard static IP. Route a request to the IP check endpoint and read the response.

import os, requests
proxies = {"http": os.environ["QUOTAGUARDSTATIC_URL"], "https": os.environ["QUOTAGUARDSTATIC_URL"]}
print(requests.get("https://ip.quotaguard.com", proxies=proxies).json())

{"ip":"<one of your two QuotaGuard static IPs>"}

The returned IP must be one of the two static IPs in your dashboard. Add both addresses to the destination’s allowlist. A short test can return the same address repeatedly because of load balancing and connection reuse; it does not need to display both addresses to prove the configured request used QuotaGuard.

Outbound and Inbound

Outbound is the main case for Replit. Your app calls out to a database or API, and the destination checks the source IP. Everything above covers this direction.

Inbound applies when a partner or enterprise system needs to reach your Replit app from a known address. QuotaGuard includes inbound proxy on all direct plans (Starter and above), and QuotaGuard Shield covers the inbound path when that incoming traffic is regulated.

Troubleshooting

The request still comes from a Replit IP, not a QuotaGuard IP The client is not using the proxy. For Node’s native fetch, confirm an Undici ProxyAgent is passed as the dispatcher. For Axios or node-fetch, confirm the appropriate proxy agent is attached. For Python requests, confirm the proxies argument is passed. Check that the Secret is set in the deployment, not only in the development workspace.

Connection times out to a database HTTP proxy settings do not cover raw TCP databases. Use QGTunnel for PostgreSQL, MySQL, or MongoDB, and confirm the tunnel’s remote host and port match your database.

407 Proxy Authentication Required The proxy credentials are wrong. Recheck the username and password in your QUOTAGUARDSTATIC_URL Secret against the dashboard. A credential with a special character may need URL-encoding.

It works in the editor but not in the deployment Secrets set in the editor are not always present in a deployment. Confirm the Secret exists for the deployed app, then redeploy.

A Static deployment cannot make the runtime request Static deployments can use secrets during their build, but they do not run backend code after publication. Use an Autoscale or Reserved VM deployment when the published application must make a server-side outbound call from a stable identity.

SSL/TLS errors in Node.js Make sure you are using httpsAgent (not httpAgent) for HTTPS requests when configuring Axios or similar clients.

QuotaGuard Static vs QuotaGuard Shield

Static is right for most Replit apps. HTTPS payloads remain encrypted through Static’s blind CONNECT tunnel and are not decrypted by the proxy; the HTTP proxy protocol on the Replit-to-proxy hop is not itself TLS-wrapped. Choose Shield when a security policy or approved compliance architecture requires TLS on that customer-to-proxy hop. Regulated data alone does not make Shield an automatic requirement; use the product and architecture approved for the workload.

Ready to Get Started?

Get in touch or create a free trial account.

Try QuotaGuard Now

Contact Support