Static Inbound & Outbound IPs for Vercel

Vercel's native Static IPs are a Pro-and-Enterprise feature, enabled per project, on a shared pool of outbound-only addresses, with regional data-transfer fees on the traffic.

QuotaGuard is one flat plan whose two IPs serve all your projects and any other platform you run, with bandwidth bundled and no per-GB overage.

It also adds the two things the native feature does not: a fixed inbound IP for partners and webhooks, and raw-TCP database tunneling.

For a single Pro project with only outbound calls, Vercel's feature may be enough; past that, the proxy is usually cheaper and does more.

Not from the environment variable alone.

In the Node runtime, Next.js uses the built-in fetch, which runs on Undici and ignores HTTPS_PROXY, so a request still leaves from a rotating IP until you wire the proxy in.

Set an Undici ProxyAgent as the global dispatcher with setGlobalDispatcher, or enable NODE_USE_ENV_PROXY on Node 24 and later; if you use axios or node-fetch instead, pass an https-proxy-agent.

The Edge runtime is more restricted, so route proxied calls from standard Node functions.

Whitelisting Vercel's dynamic ranges opens your firewall to every other customer's traffic on the same infrastructure, which defeats the point of an allowlist.

Your two QuotaGuard IPs belong to your subscription, so the destination can trust your traffic alone.

Because these are cloud IPs, this is for professional B2B allowlisting, not for reaching consumer sites that block cloud ASNs.

From a temporary server-side route, make a request through the proxy to https://ip.quotaguard.com.

It returns the IP the destination sees, which should match one of the two addresses in your QuotaGuard dashboard.

Call it more than once and you will see both, because the pair is load-balanced, so add both to the destination allowlist.

Yes.

With the connection URL set as a project environment variable, build-time outbound calls route through your static IP just like runtime calls.

This matters for database migrations and for Static Site Generation that pulls from a firewalled backend during the build, which would otherwise reject Vercel's build servers.

Routing through a proxy adds a small amount of latency, so raise the maxDuration in your vercel.json or route config enough to cover the full round trip of the database or API call.

A function that returns a 504 timeout under a proxy is almost always one whose duration cap was left at the default, not a proxy fault.

Static satisfies the allowlist and is enough for most Vercel apps. Use Shield when the data is regulated under HIPAA, PCI-DSS, or SOC 2, or when a security policy requires that no proxy can decrypt the traffic.

Shield uses SSL passthrough, so it routes the encrypted session without ever holding a key to read it. The allowlist sees a static IP on either product, so the choice is about the data, not connectivity.

QuotaGuard's outbound proxy covers your functions calling out, and inbound covers a partner or webhook sender reaching your app at a fixed address, which Vercel's outbound-only feature cannot do.

Dedicated IPs are included on QuotaGuard Enterprise, $219 per month for Static and $269 per month for Shield on direct billing, while Starter, Production, and Business share static IPs across customers.