1
Choose Static or Shield
Static is the normal choice for standard HTTPS traffic. Shield is for architectures requiring SSL passthrough or where traffic must not be decrypted at the proxy.
Inbound Static IPs
Give Customers and Partners Static IPs for Reaching Your Application
When a customer's firewall permits connections only to approved destination IPs, QuotaGuard puts a stable, fault-tolerant IP pair in front of the cloud application you already operate. Keep your hosting platform, application code, and deployment process. QuotaGuard manages the proxy infrastructure, routing, availability, monitoring, failover, and maintenance.
From $19/month•Two stable static IPs•12 global regions•Free trial
From $19/month • Free trial
Two stable static IPs
12 global regions
This Is the Right Setup When Customers Need Fixed IPs to Reach You
- A customer asks which destination IPs its firewall should allow.
- A partner can connect only to approved addresses.
- Your cloud application does not have stable public destination IPs.
- You want to provide a fixed endpoint without moving the application.
- Customer firewall changes require approvals, tickets, or maintenance windows.
Need stable source IPs for your application to connect to another API, database, or firewall? See Outbound Static IPs →
A Stable Front Door for the Application You Already Run
Customer or Partner Network
QuotaGuard Hostname Backed by Two Static IPs
QuotaGuard Managed Inbound Proxy
Your Existing Cloud Application
- Customers connect through the configured hostname.
- Customers allowlist both static IPs.
- QuotaGuard routes the request to the application origin.
- The application can remain on Railway, Render, Heroku, Vercel, AWS, Azure, Google Cloud, Kubernetes, or another reachable platform.
- Customers do not connect directly to a raw shared IP address.
Commercial Proof
Offer Static Destination IPs as Part of Your Own Service
Keygen documents that it uses QuotaGuard to provide static destination IPs to eligible Keygen Cloud customers. Keygen owns the customer experience while QuotaGuard operates the managed network layer underneath.
See How Keygen Uses QuotaGuard →Your Customer
Your Branded Static Endpoint
QuotaGuard Infrastructure
Your Application
Get a Stable Inbound Endpoint in Four Steps
2
Create the Inbound Route
Enter the reachable application URL that should receive forwarded traffic.
3
Choose the Customer-Facing Hostname
Use the QuotaGuard-generated hostname or configure your own approved domain. DNS and certificate requirements depend on whether you select Static or Shield.
4
Give the Customer the Connection Information
Provide the hostname, both static IPs, port, protocol, expected path, authentication method, and support contact. Test the complete connection from the customer's restricted network.
Dashboard setup is self-service. New inbound configurations can take up to 10 minutes to propagate.
Keep the Application. Stop Operating the Static Front Door.
QuotaGuard Manages
- Stable address pair
- Proxy infrastructure
- Load balancing and failover
- Monitoring and maintenance
- Capacity and upgrades
- Regional placement
- Engineering support
- Production network operations
Operating It Yourself Means
- Redundant reverse proxies
- Public address management
- Health checks
- TLS handling
- Monitoring and patching
- Capacity planning
- Incident response
- Another production service to run
Choose the Inbound Architecture That Matches Your Traffic
Most Common for Standard Inbound
QuotaGuard Static
Best for
Standard SaaS APIs, customer portals, callbacks, and ordinary HTTPS traffic
Inbound TLS
TLS terminates at the QuotaGuard inbound proxy
Infrastructure
Stable IP pair on managed shared infrastructure
$19/month
Start Static TrialQuotaGuard Shield
Best for
Sensitive or regulated traffic requiring SSL passthrough
Inbound TLS
Traffic remains encrypted through the QuotaGuard proxy
Infrastructure
Stable IP pair on managed shared infrastructure
$29/month
Start Shield TrialEnterprise Dedicated
Best for
Contracts, security reviews, or architectures requiring customer-only IPs and proxy resources
Infrastructure
Dedicated static IPs and dedicated proxy resources
Static Enterprise from $219/month
Shield Enterprise from $269/month
What to Know Before You Configure Inbound Traffic
QuotaGuard typically adds only a few milliseconds of latency.
Choose from 12 global regions to place the proxy close to your application and expected customers.
Test representative production traffic before launch.
The application origin must be reachable by the selected proxy architecture.
Customers connect through the configured hostname.
Both assigned IPs should be allowlisted for availability.
Standard plan addresses are stable but shared.
Customer-only addresses require Enterprise.
Static terminates inbound TLS at QuotaGuard.
Shield is the appropriate path when proxy-level TLS termination is unacceptable.
Static IP allowlisting does not replace authentication, authorization, request validation, rate limits, or logging.
Give Customers a Stable Destination Without Moving Your Application
Keep your application on the platform you already use. Give customers two stable addresses they can approve, and let QuotaGuard operate the network infrastructure behind them.
Real answers from the engineers who operate QuotaGuard. No chatbot and no scripted support.
Frequently Asked Questions
What is a static inbound IP?
A static inbound IP gives customers, partners, and webhook providers a fixed, allowlistable destination for reaching your application. They connect through your configured hostname, which resolves to your QuotaGuard IP pair, and QuotaGuard forwards the request to your application. Your application's underlying cloud IP can change without disrupting the integration.
Is an inbound IP different from an outbound IP?
Inbound and outbound describe the direction of the connection, not separate sets of addresses. Outbound traffic leaves your application through your static IPs, while inbound traffic reaches your application through them. With QuotaGuard, the same stable pair supports both directions, so you do not need to manage two different IP lists.
Why are there two static IP addresses?
Every subscription includes a load-balanced pair on separate proxy nodes for availability. If one node has a problem, new connections can continue through its partner without introducing an unexpected third address. Allowlist both IPs so your integration receives the full benefit of the redundant design.
Can customers connect directly to the IP addresses?
On standard shared plans, customers connect through the QuotaGuard hostname or your custom domain rather than entering a raw IP. The hostname identifies which application should receive the request on the shared proxy, just as it does with other managed web infrastructure. Callers still use an ordinary HTTPS URL, so there is no special client software or unusual integration process. Direct HTTP access by raw IP is available with an Enterprise dedicated proxy when a specific integration requires it.
Can I use my own domain?
Yes. You can use a customer-friendly domain such as api.example.com instead of displaying the QuotaGuard-generated hostname. Setup is handled with a DNS CNAME and the appropriate certificate configuration: Static terminates TLS at the inbound proxy using your uploaded certificate, while Shield uses SSL passthrough so TLS remains encrypted through QuotaGuard and terminates at your application.
Does my customer need a QuotaGuard account?
No. Your customer simply connects to the hostname you provide using its normal HTTP or HTTPS client. There is no QuotaGuard account to create, software to install, or QuotaGuard credential to manage on their side. You control the subscription and present the static endpoint as part of your own service.
Are standard QuotaGuard IPs dedicated?
Standard plans use managed shared IP addresses and shared proxy resources, but your assigned pair remains stable and suitable for allowlisting. Each subscription has its own credentials, and customer traffic remains logically separated. If a partner requires customer-only addresses and dedicated proxy resources, Enterprise provides both.
Should I use Static or Shield?
Static is the simpler, lower-cost choice for most general HTTPS, webhook, and allowlisting use cases. It terminates inbound TLS at the QuotaGuard proxy and forwards the request to your application. Choose Shield when you handle regulated data or require SSL passthrough, which keeps the connection encrypted through QuotaGuard and lets your application terminate TLS using certificates you control.
Will the inbound proxy add latency?
Yes, but typically only a few milliseconds. QuotaGuard operates across 12 global regions, so you can place the proxy close to your application and keep the additional network distance minimal. As with any production network change, test the complete route with representative traffic before launch.
Does a static destination replace application authentication?
No. A static destination solves the network allowlisting requirement by giving trusted systems a predictable endpoint, but it does not identify or authorize individual requests. Keep your application's existing authentication, authorization, request validation, rate limits, and logging in place. The static IP becomes an additional network control within that layered security model.