Route Auth0 Management API and SCIM calls through the two stable IPv4 addresses included with each QuotaGuard subscription. Add both addresses to a Tenant ACL with management scope so Auth0 can reject off-list sources at the tenant edge.
Auth0's native management scope covers /api/v2/* and /scim/*. Token scopes and permissions still determine what each approved request may do.
If you also use a Credentials Exchange Action to inspect M2M token requests, route the separate /oauth/token exchange through the same QuotaGuard pair.
Tenant ACL is Auth0's native traffic-control layer for the tenant edge. Use its management scope to apply source-based rules to Management API and SCIM requests without changing the tokens or application permissions behind the boundary.
QuotaGuard supplies the small, stable source set that makes this policy practical for customer-controlled cloud applications.
Auth0 documents management scope as covering /api/v2/* and /scim/*. A source rule can allow the two QuotaGuard addresses while blocking requests that arrive from outside the approved set. See Auth0's Tenant ACL documentation for the current rule model.
Auth0 currently includes one Tenant ACL with Enterprise. Enterprise tenants with the Attack Protection add-on can create up to ten, and the current parameter reference supports up to twenty entries for a source identifier. The add-on increases the number of ACLs; it is not required for the first one.
Auth0 supports a log action that records how matching traffic would be handled. Validate the QuotaGuard route and every required Management API or SCIM client in that mode, then change the final rule to the intended blocking behavior.
An Auth0 Credentials Exchange Action and a Tenant ACL run at different points. Use the Action only when the M2M token exchange needs its own source check, and keep the Tenant ACL responsible for later Management API and SCIM requests.
The management-scope ACL applies when a request reaches the covered Auth0 API path. That is the request-level boundary that blocks an issued token when it is later presented from an unapproved network source.
Auth0's Credentials Exchange trigger runs before an M2M access token is returned and exposes the originating request IP. It can deny that exchange, but it does not inspect every later request made with the issued token.
Proxy the /oauth/token request when the Action checks its source, and proxy each covered /api/v2/* or /scim/* request when Tenant ACL checks the source. Sending only the API call through QuotaGuard leaves the token request outside the Action's approved pair.
Every QuotaGuard subscription receives two load-balanced static IPv4 addresses. Register both addresses in Auth0 and route only the customer-controlled calls that need the stable network identity.
The pair belongs to the subscription, not the account, and either address may carry a valid request.
Adding only one address creates an incomplete source policy because traffic can leave through either side of the load-balanced pair. Use the two dashboard values from the exact QuotaGuard subscription that carries the Auth0 traffic.
QuotaGuard Static carries HTTP and HTTPS proxy traffic on port 9293 and SOCKS5 on port 1080. Shield uses port 9294 for HTTPS proxy traffic and port 1081 for Secure SOCKS, adding encryption from the application to the proxy. Neither product decrypts the application's outbound HTTPS payload.
QuotaGuard operates in twelve AWS regions, including US-East-1 in Virginia and US-East-2 in Ohio. Select the subscription region that fits the application path, then register that subscription's two exact addresses with Auth0.
Common questions about Auth0 static IPs and QuotaGuard.
Does Auth0 support native Management API IP restrictions?
Yes. Auth0 Tenant ACL can evaluate source-IP signals and apply a rule with management scope to /api/v2/* and /scim/*. Route those requests through QuotaGuard, register both subscription IPs, and use an allow-and-block rule pattern that matches the tenant's intended access policy.
Which Auth0 plan includes Tenant ACL?
Auth0 currently includes one Tenant ACL with Enterprise. Enterprise with the Attack Protection add-on supports up to ten ACLs. The add-on increases the ACL limit; it is not required for the first Enterprise ACL.
Which Auth0 requests should go through QuotaGuard?
Proxy the customer-controlled Management API and SCIM calls covered by the Tenant ACL's management scope. If a Credentials Exchange Action also checks the source of M2M token requests, proxy the separate /oauth/token call through the same pair. Other application traffic does not need to use this route unless its own policy requires it.
Do I need to register both QuotaGuard IPs in Auth0?
Yes. Every subscription has two load-balanced static IPv4 addresses, and traffic can leave through either one. Add both dashboard values to the applicable Auth0 source rule so failover does not move a valid request outside the approved set.
Does a Credentials Exchange Action replace Tenant ACL?
No. The Action runs before Auth0 returns an M2M token and can deny that token exchange based on custom logic, including the originating IP. Tenant ACL is the separate request-level control for later Management API and SCIM calls. Use either or both according to the security design, but do not describe them as the same enforcement point.
Should I use QuotaGuard Static or Shield for Auth0?
Static is sufficient for most HTTPS Auth0 API clients that need a stable source. The application's HTTPS session to Auth0 remains encrypted, and QuotaGuard does not decrypt its payload. Shield additionally encrypts the customer-to-proxy hop. Neither product makes the Auth0 environment compliant by itself.
Can I get dedicated IPs for Auth0?
Yes. Dedicated IPs and proxy resources are included on direct Enterprise plans, currently $219 per month for QuotaGuard Static and $269 per month for QuotaGuard Shield. Direct Starter, Production, and Business plans use stable shared IP pairs. A shared pair still provides the fixed source addresses needed by an Auth0 rule unless the customer's policy also requires exclusive proxy resources.
Do Auth0's published IP ranges replace this QuotaGuard setup?
No. Auth0 publishes ranges for traffic that originates from Auth0 services such as Actions and Log Streams. This integration covers the opposite direction: requests traveling from the customer's application through QuotaGuard to Auth0. Auth0-originated callbacks, streams, and other inbound traffic need their own receiving-end policy.
For over a decade, QuotaGuard has provided reliable, high-performance static IP and proxy solutions for cloud environments like Heroku, Kubernetes, and AWS.
Get the fixed identity and security your application needs today.