Replit Static IPs
QuotaGuard gives your Replit backend two fixed outbound IP addresses, so the databases and APIs that allowlist by IP keep accepting your app through every deploy.
Replit runs each published app in a single-tenant Google Cloud project and hands the container a new egress IP on every deploy and restart, with no setting to reserve one. You add the two QuotaGuard IPs to the destination once and they hold.
Static covers most outbound calls. Shield adds SSL passthrough for data a security review will not let a proxy decrypt.
Which Replit Deployments Get a Fixed IP, and Why It Rotates
Your Replit backend gets one fixed network identity on the deployment types that run server code, which are the apps that actually open outbound connections. It is set with a single Secret and no change to your hosting.
The rotation you are fighting is built into how Replit publishes. A published app is a snapshot running in your own single-tenant Google Cloud project, and each deploy or restart starts a fresh container with a fresh egress IP from Google's pool. There is no reserved-egress toggle on Replit.
Wire the Proxy to the Way Your App Connects
One Secret gives every outbound call a fixed source IP. The wiring is short, and it depends on your HTTP client and on whether you are reaching an API or a raw-TCP database.
The QuotaGuard connection URL is injected as an environment variable, and from there the client picks it up. There is one difference between the common Python and Node paths that trips people, so it is worth getting right before you ship.
Python requests Reads It, Node Native fetch Does Not
Python's requests honors the HTTPS_PROXY environment variable automatically, so the Secret alone routes its calls through your static IPs.
Node's built-in fetch is different. It runs on Undici and ignores both the HTTPS_PROXY variable and the older https-proxy-agent library. You route native fetch by setting an Undici ProxyAgent as the global dispatcher with setGlobalDispatcher, or by enabling NODE_USE_ENV_PROXY on Node 24 and later. The node-fetch and axios libraries still accept an https-proxy-agent through their agent option, so the right fix depends on which client your app actually uses.
Databases Over Raw TCP Use QGTunnel
A PostgreSQL, MySQL, or MongoDB connection speaks raw TCP, not HTTP, so an HTTP proxy does not carry it. QGTunnel handles this layer instead.
QGTunnel intercepts the database connection and routes it through your static IPs transparently. Your driver connects to the normal host, including an external database your Replit app reaches by a connection-string environment variable, while egress arrives from the fixed pair.
Allowlist Both IPs on the Destination
Each subscription includes two static IPs in a load-balanced pair with automatic failover, and a request can exit from either address. Add both to the destination's allowlist, firewall, or security group in one pass.
Allowlisting only one means a failover to the second address starts getting rejected, which produces intermittent failures that are painful to trace.
Static, Shield, and Where Your Egress Lives
Static satisfies the allowlist for most Replit apps, and the choice past that is about the data, not about getting the connection through.
The destination only ever sees a fixed IP, which is true on either product. What changes is whether a proxy in the path can read the traffic, and where in the world your egress sits.
FAQs
Common questions about Replit Static IPs and QuotaGuard.
Only if it connects to something that allowlists by IP, such as a database firewall, a partner API, or a payment provider.
Replit gives the container a fresh egress IP on every deploy and restart, so a destination that pinned the old address starts refusing the connection.
You can confirm what the destination sees by routing a request through the proxy to https://ip.quotaguard.com, which returns the static IP.
If nothing you call restricts by source IP, you do not need one.
Autoscale, Reserved VM, and Scheduled deployments, because they run backend code and support Secrets.
Static deployments serve files only, have no Secrets, and make no server-side outbound calls, so a static IP does not apply to them.
Apps built with Replit Agent are full-stack and are not compatible with Static deployments, so they already run on Autoscale or Reserved VM, where this setup applies.
Python's requests reads the HTTPS_PROXY environment variable automatically, so adding the Secret is enough.
Node's built-in fetch runs on Undici and ignores both HTTPS_PROXY and the https-proxy-agent library, so you set an Undici ProxyAgent as the global dispatcher with setGlobalDispatcher, or enable NODE_USE_ENV_PROXY on Node 24 and later.
If you use node-fetch or axios instead of native fetch, those accept an https-proxy-agent through their agent option.
Yes. HTTP and HTTPS APIs route through the proxy set as a Secret, and raw TCP databases route through QGTunnel.
PostgreSQL, MySQL, and MongoDB speak TCP rather than HTTP, so QGTunnel intercepts the connection and sends it through your static IPs while your driver connects to the normal host.
You add the two IPs to the database's firewall or security group once.
Static satisfies the allowlist and is enough for most Replit apps.
Use Shield when the data is regulated under HIPAA, PCI-DSS, or SOC 2, or when a security policy requires that no proxy can decrypt traffic.
Shield uses SSL passthrough, so it routes the encrypted session without ever holding a key to read it.
The allowlist sees a static IP on either product, so the choice is about the data, not connectivity.
No.
The two static IPs belong to your QuotaGuard subscription, not to the Replit container.
A deploy or restart cycles Replit's underlying egress IP, but your traffic still exits through the QuotaGuard pair, so the destination keeps seeing the same two addresses.
You allowlist them once and never revisit it as Replit cycles the container.
Yes.
Dedicated IPs are included on QuotaGuard Enterprise plans, which are $219 per month for Static and $269 per month for Shield on direct billing.
On Starter, Production, and Business the two IPs are still static but shared with other QuotaGuard customers.
A dedicated pair matters when a destination's allowlist must contain only your traffic, with no other organization originating from the same address.
QuotaGuard's outbound proxy covers your app calling out, and inbound covers a partner or service reaching your app on a fixed address.
If a webhook sender or enterprise system requires a known, stable endpoint IP, QuotaGuard Static includes inbound proxy on direct plans from $19 per month, and Shield covers the inbound path when that traffic is regulated. Inbound uses the same two static IPs as your outbound traffic.
Still have questions?
We don’t outsource Support to non-Engineers.
Reach out directly to the Engineers who built Shield to discuss your specific architecture, integration challenges, or compliance constraints here 👇
🚀 Ready to Get Started? Choose Your QuotaGuard Path
QuotaGuard STATIC
QuotaGuard SHIELD
Trusted by Engineering Teams Everywhere
Reliability Engineered for the Modern Cloud
For over a decade, QuotaGuard has provided reliable, high-performance static IP and proxy solutions for cloud environments like Heroku, Kubernetes, and AWS.
Get the fixed identity and security your application needs today.