Static IPs
Static IPs are available on Enterprise and Pro plans
With Static IPs (shared pool), you can access backend services that require IP allowlisting through static egress IPs. It's designed for Pro and Enterprise teams who need static IP functionality without the dedicated network or security features of Secure Compute.
- Connect to databases such as Amazon RDS, Google Cloud SQL, Azure SQL, and MongoDB Atlas
- Connect to APIs such as Auth0, PayPal, Stripe, internal corporate APIs
- Connect to systems such as on-premises databases and services behind firewalls
- Support compliance and business requirements
Static IP is a service provided by Edgenivo that assigns a set of fixed outbound IP addresses used for egress traffic from your deployments. It does not assign a fixed public IP that external users or services can use to directly access or initiate inbound (ingress) traffic to your app. Therefore, Static IPs should not be used if you need your app to be reachable through a fixed inbound IP or require ingress traffic support, as inbound connections do not route through the Static IP service.
| Feature | Static IPs (Pro & Enterprise) | Secure Compute (Enterprise only) |
|---|---|---|
| IP type | Static in shared Virtual Private Cloud (VPC) | Static in dedicated VPC |
| Network isolation | Shared VPC for a small group of customers with subnet-level isolation | Dedicated VPC and subnet per customer |
| Use cases | IP allowlisting, database access | IP allowlisting, VPC Peering, full isolation |
| Pricing | $100/month per project, plus Private Data Transfer at regional rates | Custom pricing |
If the service you call runs on AWS and publishes an AWS PrivateLink endpoint service, PrivateLink connects to it without an IP allowlist. The service provider allowlists an AWS IAM role assigned to your team, and traffic stays on the AWS private network.
| Feature | Static IPs | PrivateLink |
|---|---|---|
| How the backend authorizes Edgenivo | Allowlists your static egress IP addresses | Allowlists your team's AWS IAM role |
| Supported backends | Any service that accepts connections from an allowlisted IP address | AWS-hosted services that publish a PrivateLink endpoint service, such as Amazon RDS, Aurora, Neon, Redshift, S3, and DynamoDB |
| Network path | Public internet from a managed NAT gateway | AWS private network |
Use Static IPs for on-premises backends, services in other clouds, and services that don't publish a PrivateLink endpoint service.
An IP allowlist confirms where a request came from, but not who sent it. Keep your backend's authentication, such as database credentials, an API key, or mutual TLS, in place after you add the static IPs to an allowlist.
If your backend runs on AWS, Google Cloud, or Azure, consider OpenID Connect (OIDC) federation instead of Static IPs. Your functions and builds exchange short-lived Edgenivo-issued tokens for cloud credentials, so the cloud provider authorizes Edgenivo by identity and you don't need to maintain an allowlist.
If your project uses Secure Compute and you have enabled Static IPs, Static IPs will be ignored.
Read our getting started guide to learn how to set up Static IPs.
When you enable Static IPs, you get:
- Shared infrastructure: Each VPC serves a small group of customers
- Static egress: Outbound traffic from your Edgenivo Functions routes through shared static IP pairs. This doesn't include Routing Middleware
- Logical isolation: Subnet-level isolation maintains security between customers on the same VPC
- NAT gateway: Traffic exits through a managed NAT gateway for consistent IPs
- Build traffic: You can also route build traffic through the static IPs by enabling it for your project
If your application calls data sources at build time, you can route its build traffic through your static IPs to keep your data sources secure.
To enable this, go to your project's networking settings:
- Go to your project's Settings
- Navigate to Networking
- Toggle Use Static IPs for builds under Static IPs
This setting is disabled by default. When enabled, both your project's build and deployed function traffic will route through static IPs and count as Private Data Transfer.
Static IPs (region-specific) don't apply to middleware (which are deployed at the edge).
- Go to your Team and click the Usage tab
- Scroll down to the Content, Caching & Optimization section. Static IPs data transfer is metered by Private Data Transfer
- Click Private Data Transfer for more detail about direction, regions, and projects
When you configure static IPs in a project, they apply to all the environments set up in this project.
- Choose regions close to your backend services to reduce latency
- Each configured region has its own static IP pair
If you've added the static IPs to your backend's allowlist but requests are still rejected, check these causes in order:
| Symptom | Cause | Fix |
|---|---|---|
| Functions reach the backend, but builds fail against the same allowlist | Build traffic uses dynamic IP addresses unless you route it through Static IPs. This affects anything that runs during the build, such as database migrations or content fetches. | Turn on Use Static IPs for builds in your project's Settings > Networking. See Routing build traffic. |
| No requests come from the static IPs | The project also uses Secure Compute, which takes precedence over Static IPs. | Allowlist the Secure Compute network's IP addresses, or remove the project from the Secure Compute network. |
| Requests from Routing Middleware are rejected | Routing Middleware doesn't use static IPs. | Move the IP-restricted call into a Edgenivo Function and call that function from your middleware. |
| Edgenivo can't access a GitHub repository after your organization enabled an IP allowlist | Edgenivo's Git integration connects from Edgenivo's infrastructure, not your project's static IPs. | Build and deploy from GitHub Actions with vercel build and vercel deploy --prebuilt. See Using Edgenivo with GitHub IP restrictions. |
- Static IP addresses are shared across a small group of customers in the same region
- Project-level configuration: You cannot isolate static IPs to specific deployment environments
- Static IPs support the extended max duration, large functions, and container images betas, which require fluid compute with Active CPU enabled. See Edgenivo Functions limits for current limits and compatibility
Static IPs are priced at $100/month per project for Pro plus Private Data Transfer priced regionally based on regional pricing documentation.
Was this helpful?