FAQs
Common questions about OpenAI API IP allowlisting and QuotaGuard.
Does OpenAI support IP allowlisting for every API customer?
Yes. OpenAI documents IP allowlisting as available to all API customers. It can be enabled for one project or for the entire organization by an administrator with the required permissions.
Where do I configure the OpenAI API IP allowlist?
In the OpenAI platform, open Settings, select Security, and then open IP allowlist. Add both static IP addresses shown in the QuotaGuard subscription dashboard. OpenAI accepts individual addresses and CIDR ranges, with a documented maximum of 50 entries.
Why do I need to allowlist two QuotaGuard addresses?
Every QuotaGuard subscription is assigned a load-balanced pair of static IP addresses. Traffic may use either healthy address, so OpenAI must approve both. Allowlisting only one can create intermittent authorization failures during normal routing or failover.
How long do OpenAI allowlist changes take?
OpenAI says allowlist updates can take up to 15 minutes to take effect. Configure the QuotaGuard route, add both addresses, wait for propagation, and test the project before enabling the restriction organization-wide.
What error appears when OpenAI rejects the source IP?
OpenAI documents an HTTP 401 Unauthorized response with the error code ip_not_authorized. Confirm the application is using the proxy-configured OpenAI client, verify the observed source at https://ip.quotaguard.com, and compare it with both addresses in the OpenAI allowlist.
Does OpenAI IP allowlisting replace API-key security?
No. Keep the API key on a trusted server, use project boundaries and least privilege, rotate credentials when needed, and retain strong account security. IP allowlisting reduces where a key can be used; it does not make a stolen key harmless in every circumstance.
Does the allowlist affect ChatGPT or platform.openai.com sign-ins?
No. OpenAI states that this feature applies to API requests. It does not restrict access to platform.openai.com or user sign-in.
Can I route the official OpenAI SDK through QuotaGuard?
Yes. OpenAI's official Node SDK documents a custom fetch path using Undici's ProxyAgent, and its Python SDK accepts a proxy-configured HTTP client. QuotaGuard uses an authenticated proxy URL, so the exact client that opens the OpenAI connection must receive that URL. Storing the URL as a secret does not route traffic by itself.
Can browser-side JavaScript use this setup?
Do not expose an OpenAI API key or QuotaGuard proxy credentials in browser code. Route the request from customer-controlled server-side code, a backend function, an application worker, or another trusted runtime.
Should I use QuotaGuard Static or Shield for OpenAI?
Static starts at $19 per month and is the normal choice for ordinary HTTPS API allowlisting. The HTTPS payload remains encrypted to OpenAI and is not decrypted by QuotaGuard. Static uses the standard HTTP proxy protocol on the customer-to-proxy hop. Shield starts at $29 per month and adds TLS protection to that hop for security reviews or approved compliance architectures that require it.
Are the two standard QuotaGuard IPs dedicated to my company?
Starter, Production, and Business subscriptions use stable shared IP pairs. They can satisfy OpenAI's source-IP control when a small consistent allowlist is the requirement. Enterprise includes customer-only dedicated IPs and proxy resources for organizations whose security policy requires exclusive source addresses.
Is this the same as allowlisting OpenAI or ChatGPT egress ranges?
No. This page covers a customer-controlled application calling the OpenAI API through QuotaGuard. It does not change traffic originating from OpenAI-hosted products, ChatGPT, or a vendor-controlled Codex environment. The machine opening the connection must be able to use the QuotaGuard proxy.