Lovable

Lovable applications can call external services from Lovable Cloud server-side functions, custom connectors, or a separately deployed backend. When a payment provider, exchange, enterprise API, or customer firewall requires a small stable source-IP allowlist, QuotaGuard gives selected server-side requests a managed and portable outbound identity.

QuotaGuard operates the egress infrastructure for you. That includes availability, failover, monitoring, capacity, maintenance, upgrades, engineering support, and incident response. The identity can remain portable if the application later moves from Lovable Cloud to Vercel, Netlify, Railway, Render, or another supported runtime.

• Server-Side Configuration: Store the QuotaGuard connection URL in Lovable's server-side Secrets and configure the server-side HTTP client that makes the protected request to use it. Adding a secret alone does not route traffic. Never expose proxy credentials in browser-delivered React code.
• Lovable Native Option: Lovable also provides gateway-based custom connectors with shared fixed IPv4 185.41.150.0/25 and IPv6 2a07:8241:fca::/48 ranges. That may be sufficient when the destination accepts the shared ranges and the connector supports the API's authentication and request model.
• Why QuotaGuard: Choose QuotaGuard when the customer needs a much smaller allowlist, an identity portable outside Lovable, selective routing outside the connector model, engineering support, or customer-only addresses through Enterprise dedicated infrastructure.
• Managed Reliability: Standard subscriptions provide a stable pair of addresses on shared managed proxy infrastructure. Allowlist both addresses. When security policy requires customer-only source addresses, use an Enterprise dedicated configuration.
• Defense in Depth: A static source address is one security layer, not a replacement for authentication or authorization. Protect the destination with HTTPS, narrowly scoped credentials or mTLS where supported, least-privilege authorization, rate limits, logging, alerts, and credential rotation.

Architectural note: Static IP proxying must originate from server-side code, never from the React frontend running in the user's browser. If the selected Lovable runtime or HTTP client cannot use an authenticated proxy directly, place the protected request in a customer-controlled backend or relay that can.