Replit Static IPs

Give selected Replit API and database connections two stable outbound IPs with a self-service, managed route that stays portable beyond Replit.

Replit advertises static outbound IPs on custom-priced Enterprise. QuotaGuard is the normal route when you need two stable addresses without an Enterprise contract, want selective routing, or want QuotaGuard to own availability, failover, monitoring, and support.

Static is the normal starting point and does not decrypt HTTPS payloads passing through its blind CONNECT tunnel. Shield adds TLS on the Replit-to-proxy hop when policy or an approved compliance architecture requires it.

Replit logo linked by a line to a shield with a grid icon and a padlock, symbolizing security.

Which Replit Deployments Need a Stable Outbound Identity

Your Replit backend gets a stable outbound identity on deployment types that run server code. Store the QuotaGuard connection URL as a Secret, then explicitly configure each HTTP client or supported TCP route that needs the static path, without changing where the app is hosted.

Replit advertises native static outbound IPs on its custom-priced Enterprise plan, but its public documentation does not define deployment coverage, IP count, exclusivity, or routing behavior. On plans without a documented static-egress feature, do not treat an observed outbound address as permanent. QuotaGuard provides a self-service, portable pair without requiring a custom Enterprise contract.

Replit Enterprise and Standard-Plan Egress

Replit Publishing Geography is available on Core, Pro, and Enterprise, with North America, Europe, Asia, South America, and Australia documented as available or rolling out. Geography controls where the app runs; it is not itself a promise that a standard-plan outbound IP remains fixed.

On a plan without documented static egress, the outbound address is not a durable identity you should pin in a firewall. When the source changes, the rejection often appears as a timeout or generic authentication error rather than an IP-specific message.

Secrets-Capable Deployments: Autoscale, Reserved VM, Scheduled

Store the QuotaGuard connection URL as a Secret on deployment types that support Secrets and run backend code: Autoscale, Reserved VM, and Scheduled. Then configure the application's HTTP client or supported TCP route to use it for connections to protected databases and APIs.

The connection URL goes in the Secrets panel under Tools and is injected as an encrypted environment variable at runtime, so the credential never lives in your code or your repository.

Static Deployments and Agent Apps

Static deployments serve frontend files and have no backend runtime after publication. They can use deployment secrets during a build, but browser traffic does not gain a server-side outbound identity. Use Autoscale or Reserved VM when the published app needs stable server-side egress.

Apps built with Replit Agent are full-stack with a backend, which makes them incompatible with Static deployments. They run on Autoscale or Reserved VM, which is exactly where a fixed outbound IP belongs.

Wire the Proxy to the Way Your App Connects

One Secret stores the QuotaGuard credential; it does not reroute every outbound call. Explicitly configure each HTTP client that needs the stable route, or use SOCKS5/QGTunnel for a supported raw-TCP database connection.

Replit injects the QuotaGuard connection URL as an environment variable. The application must then configure the relevant client to use it. Python requests can read the standard HTTPS_PROXY variable automatically; selective routing with QUOTAGUARDSTATIC_URL requires explicit client configuration.

Python requests Can Read HTTPS_PROXY; Node Native fetch Does Not

If you store the connection URL under the standard HTTPS_PROXY variable, Python requests honors it automatically. If you use QUOTAGUARDSTATIC_URL for selective routing, pass that URL explicitly to the requests that should use QuotaGuard.

Node's built-in fetch uses Undici. Route it with an Undici ProxyAgent passed as the request dispatcher, with setGlobalDispatcher when global routing is intentional, or with Node's supported environment-proxy mode where available. Axios uses an https-proxy-agent through its httpsAgent option; node-fetch uses one through its agent option. Configure the client the app actually uses.

Databases Over Raw TCP Use QGTunnel

A PostgreSQL, MySQL, or MongoDB connection speaks raw TCP, not HTTP, so an HTTP proxy does not carry it. QGTunnel handles this layer instead.

QGTunnel intercepts the database connection and routes it through your static IPs transparently. Your driver connects to the normal host, including an external database your Replit app reaches by a connection-string environment variable, while egress arrives from the fixed pair.

Allowlist Both IPs on the Destination

Each subscription includes two static IPs in a load-balanced pair with automatic failover, and a request can exit from either address. Add both to the destination's allowlist, firewall, or security group in one pass.

Allowlisting only one means a failover to the second address starts getting rejected, which produces intermittent failures that are painful to trace.

Diagram showing Python requests auto reads HTTPS_PROXY, Node fetch needs ProxyAgent for QuotaGuard Static IPs.

Static, Shield, and Where Your Egress Lives

Static satisfies the allowlist for most Replit apps. Choose between Static and Shield based on the security requirements for the Replit-to-proxy hop, not whether the destination can allowlist the IPs.

Both products preserve HTTPS encryption to the destination and do not decrypt the payload. Shield additionally uses TLS for the Replit-to-proxy hop; Static uses the standard HTTP proxy protocol on that hop. Both offer regional egress.

FAQs

Common questions about Replit Static IPs and QuotaGuard.

Does my Replit app need a static IP?

Only if it connects to something that allowlists by IP, such as a database firewall, a partner API, or a payment provider.

On Replit plans without documented static egress, a destination that pins an observed platform address can refuse the connection after the source changes.

You can confirm what the destination sees by routing a request through the proxy to https://ip.quotaguard.com, which returns the static IP.

If nothing you call restricts by source IP, you do not need one.

Which Replit deployment types does this work with?

Autoscale, Reserved VM, and Scheduled deployments, because they run backend code and support Secrets.

Static deployments can use secrets during their build, but they have no backend runtime after publication. A stable server-side outbound identity applies to backend workloads such as Autoscale, Reserved VM, and Scheduled deployments.

Apps built with Replit Agent are full-stack and are not compatible with Static deployments, so they already run on Autoscale or Reserved VM, where this setup applies.

How do I route the proxy in Node versus Python?

Python requests reads HTTPS_PROXY automatically when the QuotaGuard URL is stored under that standard variable. For selective routing through QUOTAGUARDSTATIC_URL, configure the relevant session or request explicitly.

Node's built-in fetch runs on Undici and ignores both HTTPS_PROXY and the https-proxy-agent library, so you set an Undici ProxyAgent as the global dispatcher with setGlobalDispatcher, or enable NODE_USE_ENV_PROXY on Node 24 and later.

If you use node-fetch, pass an https-proxy-agent through its agent option. For Axios HTTPS calls, pass it through httpsAgent and disable Axios's separate proxy parsing with proxy: false.

Does this work for database connections, not just APIs?

Yes. Explicitly configured HTTP and HTTPS clients route through the QuotaGuard proxy, and supported raw TCP database connections route through QGTunnel.

PostgreSQL, MySQL, and MongoDB speak TCP rather than HTTP, so QGTunnel intercepts the connection and sends it through your static IPs while your driver connects to the normal host.

You add the two IPs to the database's firewall or security group once.

Should I use QuotaGuard Static or Shield?

Static satisfies the allowlist and is enough for most Replit apps.

Use Static for most API and database allowlisting. Use Shield when policy or an approved architecture requires TLS on the Replit-to-proxy hop. Both products pass HTTPS payloads through without decrypting them.

Shield adds transport protection for the customer-to-proxy hop; it is not required merely because the application handles regulated data.

The allowlist sees static IPs on either product, so choose based on the security and policy requirements of the Replit-to-proxy hop rather than basic connectivity.

Will my IPs change when I redeploy?

No.

The two static IPs belong to your QuotaGuard subscription, not to the Replit container.

Replit can use dynamic outbound infrastructure, but your configured application traffic still exits through the QuotaGuard pair, so the destination keeps seeing the same two addresses.

You allowlist them once and never revisit it as Replit cycles the container.

Can I get a dedicated IP for my Replit app?

Yes.

Dedicated IPs are included on QuotaGuard Enterprise plans, which are $219 per month for Static and $269 per month for Shield on direct billing.

On Starter, Production, and Business the two IPs are still static but shared with other QuotaGuard customers.

A dedicated pair matters when a destination's allowlist must contain only your traffic, with no other organization originating from the same address.

What about inbound traffic and webhooks to my Replit app?

QuotaGuard's outbound proxy covers your app calling out, and inbound covers a partner or service reaching your app on a fixed address.

If a webhook sender or enterprise system requires a known stable endpoint IP, QuotaGuard Static includes inbound proxy on direct plans from $19 per month. Choose Shield for the inbound path when policy or an approved architecture requires its additional client-to-proxy TLS protection. Inbound uses the same two static IPs as outbound.

Still have questions?

We don’t outsource Support to non-Engineers.

Reach out directly to the Engineers who built Shield to discuss your specific architecture, integration challenges, or compliance constraints here 👇

🚀 Ready to Get Started? Choose Your QuotaGuard Path

QuotaGuard STATIC

Why: You need a rock-solid, fixed IP for general API access, AI workflows, or standard third-party integrations.
Best For: Developers, startups, and general application connectivity.
Key Feature: SOCKS5 support for secure database access.
Sign Up for QG Static for Replit

QuotaGuard SHIELD

Why: Your security policy or approved compliance architecture requires TLS on the Replit-to-proxy hop. HTTPS payloads remain encrypted through both Static and Shield.
Best For: Regulated industries, financial services, and healthcare.
Key Feature: SSL Passthrough and key isolation.
Sign Up for QG Shield for Replit

Trusted by Engineering Teams Everywhere

What our customers say

Customer experiences, in their own words. Swipe or scroll to read more.

We've been using QuotaGuard Static for nearly six years to provide static IP addresses to our clients so they are able to whitelist our network traffic.

Read full testimonial

We've been using QuotaGuard Static for nearly six years to provide static IP addresses to our clients so they are able to whitelist our network traffic.

The service has been hassle free, has never "not worked" or had any downtime to my knowledge. The only time we've reached out to support was during a migration from one cloud provider to another to ensure that we wouldn't cause interruptions in the service ourselves. The service we received at that time was prompt and professional.

Zach ColonVP of Engineering at ItsaCheckmate.comSubmitted Oct 20, 2023

The app's backend runs on serverless functions, and the railway data provider I was using only accepted requests from a fixed IP address. QuotaGuard gave me exactly that, and my passengers' PNR status checks kept working.

Read full testimonial

I used QuotaGuard Static IPs for ClearBerth, my train app for Indian Railways passengers. The app's backend runs on serverless functions, and the railway data provider I was using only accepted requests from a fixed IP address. QuotaGuard gave me exactly that, and my passengers' PNR status checks kept working.

It helped me because I could keep building the app without worrying about how to get a static IP. For a solo developer that is a real relief.

The best thing about QuotaGuard is the owner himself. Michael is kind, thoughtful and genuinely warm. When I wrote to say thank you, he replied personally, said it made his Sunday morning, and offered a returning customer discount for any future project. You do not often get that from a service company. I would happily use QuotaGuard again and I recommend it to any developer who needs a static IP.

Aditya Bhattacharya, ClearBerth

Aditya BhattacharyaFounder of ClearBerth appSubmitted Oct 18, 2026

QuotaGuard provided a static IP address via a SOCKS5 proxy. Setting up the proxy and using it from my server was very straightforward.

Read full testimonial

I have a web app running in Heroku, and that server occasionally needs to FTP files from another host. That host required requests to come from a whitelisted IP address. QuotaGuard provided a static IP address via a SOCKS5 proxy. Setting up the proxy and using it from my server was very straightforward.

Stephen BeitzelCTO, Narrative TechnologiesSubmitted Mar 28, 2024

I use QuotaGuard to connect with various APIs that require IP whitelisting and run web automations that require a country-specific IP. The stability and reliability of the service have been nothing short of exceptional.

Read full testimonial

I use QuotaGuard to connect with various APIs that require IP whitelisting and run web automations that require a country-specific IP. The stability and reliability of the service have been nothing short of exceptional. It simply works as expected and whenever I’ve had any questions Michael and the team are always very quick to respond to emails. I would recommend them without a doubt.

Jose VilchesCEO at SIM StoreSubmitted Oct 29, 2023

QuotaGuard has been a reliable partner for us for many years. Their service has consistently been solid, and when we ran into a more unusual use case, their team understood the situation quickly and worked closely with us to resolve the issues.

Read full testimonial

QuotaGuard has been a reliable partner for us for many years. Their service has consistently been solid, and when we ran into a more unusual use case, their team understood the situation quickly and worked closely with us to resolve the issues. That level of responsiveness and support has made a real difference for us.

Anton Litvinenkoco-founder @ Import2Submitted Aug 11, 2026

QG helped us prove our pipeline and workflow with users and in the end, we would have stayed but we use AWS for all our production so we had to switch. Sorry to go but loved every minute of it!

Read full testimonial

QUOTAGUARD FTW! We used qg for spooling up a prototype that needed access to MongoDB through Heroku without having to use 0.0.0.0 in mdb whitelist. Big nono for privacy and security. QG helped as we were able to add it as a resource in Heroku and test our prototype. As the platform matured, more test users came on board and our bandwidth scaled to a point where we were no longer a prototype so we moved over to AWS which is where our production apps live. The team at QG is beyond awesome. I sent an email and I think within 24hrs or less we had solved the issues with Tim and Michael. The fact they didn't pester after signup was refreshing as well. They are Dev dev's who get it. QG helped us prove our pipeline and workflow with users and in the end, we would have stayed but we use AWS for all our production so we had to switch. Sorry to go but loved every minute of it!

Greg LuttonCEO Exsurgo TechnologiesSubmitted Jun 1, 2026

Even though the issue was bank related, Michael and Randall provided exceptional support and helped me troubleshoot the issue.

Read full testimonial

I've had a issue tunneling requests to my bank's VPOS through QuotaGuard.

Even though the issue was bank related, Michael and Randall provided exceptional support and helped me troubleshoot the issue.

5 stars service, highly recommended!

Ozgur S.FounderSubmitted Jul 21, 2026

The product works great - but where they really shine is the exceptional customer service.

Read full testimonial

I needed to configure a static IP address for my app running on Heroku, so I could connect to an external database in a more secure manner. A colleague recommended Quotaguard as an option.

The product works great - but where they really shine is the exceptional customer service. One of my background workers was sneakily polling, which didnt show on the logs, and the Quotaguard support team showed patience and knowledge helping me get to the root of the problem. Fantastic team.

AlexSubmitted Aug 1, 2024

QuotaGuard is an excellent company to work with, they really helped me out on my API issue. Appreciate them as a partner.

Read full testimonial

QuotaGuard is an excellent company to work with, they really helped me out on my API issue. Appreciate them as a partner.

John William MeyerCEO, Jump FinanceSubmitted Sep 30, 2026

Solid service. :) Does what's on the tin.

Read full testimonial

Solid service. :) Does what's on the tin. They know what they're doing, and I mean that in two ways: (1) their execution of their value offering is *solid*, and (2) they appear undistracted by things that *aren't* what they're doing. A "small, sharp tools", you know?

IsaacLightwardSubmitted Jan 25, 2024

Reliability Engineered for the Modern Cloud

For over a decade, QuotaGuard has provided reliable, high-performance static IP and proxy solutions for cloud environments like Heroku, Kubernetes, and AWS.

Get the fixed identity and security your application needs today.