Replit Static IPs
Give selected Replit API and database connections two stable outbound IPs with a self-service, managed route that stays portable beyond Replit.
Replit advertises static outbound IPs on custom-priced Enterprise. QuotaGuard is the normal route when you need two stable addresses without an Enterprise contract, want selective routing, or want QuotaGuard to own availability, failover, monitoring, and support.
Static is the normal starting point and does not decrypt HTTPS payloads passing through its blind CONNECT tunnel. Shield adds TLS on the Replit-to-proxy hop when policy or an approved compliance architecture requires it.
Which Replit Deployments Need a Stable Outbound Identity
Your Replit backend gets a stable outbound identity on deployment types that run server code. Store the QuotaGuard connection URL as a Secret, then explicitly configure each HTTP client or supported TCP route that needs the static path, without changing where the app is hosted.
Replit advertises native static outbound IPs on its custom-priced Enterprise plan, but its public documentation does not define deployment coverage, IP count, exclusivity, or routing behavior. On plans without a documented static-egress feature, do not treat an observed outbound address as permanent. QuotaGuard provides a self-service, portable pair without requiring a custom Enterprise contract.
Wire the Proxy to the Way Your App Connects
One Secret stores the QuotaGuard credential; it does not reroute every outbound call. Explicitly configure each HTTP client that needs the stable route, or use SOCKS5/QGTunnel for a supported raw-TCP database connection.
Replit injects the QuotaGuard connection URL as an environment variable. The application must then configure the relevant client to use it. Python requests can read the standard HTTPS_PROXY variable automatically; selective routing with QUOTAGUARDSTATIC_URL requires explicit client configuration.
Python requests Can Read HTTPS_PROXY; Node Native fetch Does Not
If you store the connection URL under the standard HTTPS_PROXY variable, Python requests honors it automatically. If you use QUOTAGUARDSTATIC_URL for selective routing, pass that URL explicitly to the requests that should use QuotaGuard.
Node's built-in fetch uses Undici. Route it with an Undici ProxyAgent passed as the request dispatcher, with setGlobalDispatcher when global routing is intentional, or with Node's supported environment-proxy mode where available. Axios uses an https-proxy-agent through its httpsAgent option; node-fetch uses one through its agent option. Configure the client the app actually uses.
Databases Over Raw TCP Use QGTunnel
A PostgreSQL, MySQL, or MongoDB connection speaks raw TCP, not HTTP, so an HTTP proxy does not carry it. QGTunnel handles this layer instead.
QGTunnel intercepts the database connection and routes it through your static IPs transparently. Your driver connects to the normal host, including an external database your Replit app reaches by a connection-string environment variable, while egress arrives from the fixed pair.
Allowlist Both IPs on the Destination
Each subscription includes two static IPs in a load-balanced pair with automatic failover, and a request can exit from either address. Add both to the destination's allowlist, firewall, or security group in one pass.
Allowlisting only one means a failover to the second address starts getting rejected, which produces intermittent failures that are painful to trace.
Static, Shield, and Where Your Egress Lives
Static satisfies the allowlist for most Replit apps. Choose between Static and Shield based on the security requirements for the Replit-to-proxy hop, not whether the destination can allowlist the IPs.
Both products preserve HTTPS encryption to the destination and do not decrypt the payload. Shield additionally uses TLS for the Replit-to-proxy hop; Static uses the standard HTTP proxy protocol on that hop. Both offer regional egress.
FAQs
Common questions about Replit Static IPs and QuotaGuard.
Only if it connects to something that allowlists by IP, such as a database firewall, a partner API, or a payment provider.
On Replit plans without documented static egress, a destination that pins an observed platform address can refuse the connection after the source changes.
You can confirm what the destination sees by routing a request through the proxy to https://ip.quotaguard.com, which returns the static IP.
If nothing you call restricts by source IP, you do not need one.
Autoscale, Reserved VM, and Scheduled deployments, because they run backend code and support Secrets.
Static deployments can use secrets during their build, but they have no backend runtime after publication. A stable server-side outbound identity applies to backend workloads such as Autoscale, Reserved VM, and Scheduled deployments.
Apps built with Replit Agent are full-stack and are not compatible with Static deployments, so they already run on Autoscale or Reserved VM, where this setup applies.
Python requests reads HTTPS_PROXY automatically when the QuotaGuard URL is stored under that standard variable. For selective routing through QUOTAGUARDSTATIC_URL, configure the relevant session or request explicitly.
Node's built-in fetch runs on Undici and ignores both HTTPS_PROXY and the https-proxy-agent library, so you set an Undici ProxyAgent as the global dispatcher with setGlobalDispatcher, or enable NODE_USE_ENV_PROXY on Node 24 and later.
If you use node-fetch, pass an https-proxy-agent through its agent option. For Axios HTTPS calls, pass it through httpsAgent and disable Axios's separate proxy parsing with proxy: false.
Yes. Explicitly configured HTTP and HTTPS clients route through the QuotaGuard proxy, and supported raw TCP database connections route through QGTunnel.
PostgreSQL, MySQL, and MongoDB speak TCP rather than HTTP, so QGTunnel intercepts the connection and sends it through your static IPs while your driver connects to the normal host.
You add the two IPs to the database's firewall or security group once.
Static satisfies the allowlist and is enough for most Replit apps.
Use Static for most API and database allowlisting. Use Shield when policy or an approved architecture requires TLS on the Replit-to-proxy hop. Both products pass HTTPS payloads through without decrypting them.
Shield adds transport protection for the customer-to-proxy hop; it is not required merely because the application handles regulated data.
The allowlist sees static IPs on either product, so choose based on the security and policy requirements of the Replit-to-proxy hop rather than basic connectivity.
No.
The two static IPs belong to your QuotaGuard subscription, not to the Replit container.
Replit can use dynamic outbound infrastructure, but your configured application traffic still exits through the QuotaGuard pair, so the destination keeps seeing the same two addresses.
You allowlist them once and never revisit it as Replit cycles the container.
Yes.
Dedicated IPs are included on QuotaGuard Enterprise plans, which are $219 per month for Static and $269 per month for Shield on direct billing.
On Starter, Production, and Business the two IPs are still static but shared with other QuotaGuard customers.
A dedicated pair matters when a destination's allowlist must contain only your traffic, with no other organization originating from the same address.
QuotaGuard's outbound proxy covers your app calling out, and inbound covers a partner or service reaching your app on a fixed address.
If a webhook sender or enterprise system requires a known stable endpoint IP, QuotaGuard Static includes inbound proxy on direct plans from $19 per month. Choose Shield for the inbound path when policy or an approved architecture requires its additional client-to-proxy TLS protection. Inbound uses the same two static IPs as outbound.
Still have questions?
We don’t outsource Support to non-Engineers.
Reach out directly to the Engineers who built Shield to discuss your specific architecture, integration challenges, or compliance constraints here 👇
🚀 Ready to Get Started? Choose Your QuotaGuard Path
QuotaGuard STATIC
QuotaGuard SHIELD
Trusted by Engineering Teams Everywhere
Reliability Engineered for the Modern Cloud
For over a decade, QuotaGuard has provided reliable, high-performance static IP and proxy solutions for cloud environments like Heroku, Kubernetes, and AWS.
Get the fixed identity and security your application needs today.