Auth0
QuotaGuard puts two fixed outbound IPs onto your Auth0 allowlist at the connectivity layer, so you can restrict Management API access by network origin without changing where you host. Trusted by developer and platform teams securing identity infrastructure at production scale since 2013.
Auth0 has no built-in toggle to restrict the Management API by source IP. The supported patterns are a Credentials Exchange Action that checks the caller's IP, or a Tenant Access Control List allow rule. Both only work when your app leaves from a stable address. Cloud platforms like Render, Railway, Heroku, Fly.io, and AWS Lambda rotate outbound IPs on every deploy and restart, so the rule breaks the next time your dyno moves. A leaked machine-to-machine secret then works from anywhere.
- Two-Minute Setup: Add your QuotaGuard connection URL as the QUOTAGUARDSTATIC_URL environment variable in your app. Configure your HTTP client to proxy outbound calls to your Auth0 domain. Paste your two static IPs into the Action allowlist or the Tenant ACL allow rule.
- Locks the Management API Without a Native Setting: An Action on the onExecuteCredentialsExchange trigger reads event.request.ip and denies the token when the origin is not yours. Scope it to the Management API resource server so it gates M2M exchanges, not interactive logins.
- Tenant ACL Ready: Tenant Access Control List rules accept IPv4 and IPv6 CIDR across the Authentication path and the Management API under /api/v2/ and /scim/. Register the two QuotaGuard IPs as an allow rule. Tenant ACL is an Enterprise feature with the Attack Protection add-on.
- Multi-Platform Support: Works whether you host on Heroku, Render, Railway, Fly.io, AWS Lambda, Vercel, Netlify Functions, Kubernetes, or direct VPS. The same QuotaGuard configuration applies; set the env var in your hosting platform's settings.
- Production-Grade Reliability: A load-balanced pair of static IPs with automated failover. Token issuance stays consistent through deploys, restarts, and infrastructure migrations. Both IPs go on the Auth0 side, and traffic routes through whichever responds first.
- Shield for Regulated Identity Data: For SOC 2, PCI-DSS, or HIPAA-bound flows that carry regulated PII, QuotaGuard Shield uses SSL passthrough so QuotaGuard never decrypts the data moving between your app and Auth0.
Enforcement note: The Credentials Exchange Action needs no specific Auth0 plan and is the fastest way to pin the Management API to your IPs. Tenant ACL adds a second enforcement point at the tenant edge but requires an Enterprise plan with the Attack Protection add-on. Most teams start with the Action and add Tenant ACL when they qualify.