--- title: How can I allowlist IP addresses for a deployment? description: Vercel deployments use dynamic outbound IPs by default. Learn how to allowlist IP addresses for a deployment with Static IPs or Secure Compute. url: /kb/guide/how-to-allowlist-deployment-ip-address canonical_url: "https://vercel.com/kb/guide/how-to-allowlist-deployment-ip-address" published: 2025-11-03 last_updated: 2026-08-18 authors: Vercel related: - /docs/functions - /docs/networking/static-ips - /docs/networking/secure-compute - /docs/routing-middleware - /docs/networking - /kb/guide/hosting-backend-apis - /docs/builds install_vercel_plugin: npx plugins add vercel/vercel-plugin --- ## Related pages > **For AI agents:** Follow these links to understand how this page connects to the rest of the Vercel ecosystem. For the full cross-link map (inbound, outbound, prerequisites, and semantic neighbors), see the .graph.md link below. - [Kubernetes](https://vercel.com/docs/integrations/external-platforms/kubernetes?from=related) — Deploy your frontend on Vercel alongside your existing Kubernetes infrastructure. - [Getting Started](https://vercel.com/docs/networking/static-ips/getting-started?from=related) — Learn how to set up Static IPs for your Vercel projects to connect to IP-restricted backend services. - [Can I get a fixed IP address for my Vercel deployments?](https://vercel.com/kb/guide/can-i-get-a-fixed-ip-address?from=related) — Vercel deployments use dynamic IPs by default. Learn how Static IPs, Secure Compute, and AWS PrivateLink give you a fixe - [Trusted IPs](https://vercel.com/docs/deployment-protection/methods-to-protect-deployments/trusted-ips?from=related) — Trusted IPs let you restrict access to your deployments to a list of allowed IP addresses. - [Request Lifecycle](https://vercel.com/docs/fundamentals/infrastructure?from=related) — Learn how Vercel routes, secures, and serves requests from your users to your application. - [Reverse Proxy Servers and Vercel](https://vercel.com/docs/security/reverse-proxy?from=related) — Learn why reverse proxy servers are not recommended with Vercel's firewall. - [How can I use Vercel with GitHub IP restrictions?](https://vercel.com/kb/guide/use-vercel-with-github-ip-restrictions?from=related) — This guide will describe how you can use Vercel even when you have an IP allowlist configured in GitHub. - [Using Self-hosted & Reverse Proxies with Vercel](https://vercel.com/kb/guide/how-to-setup-verified-proxy?from=related) — Learn about using self-hosted or reverse proxies with Vercel deployments. - [Should I use Cloudflare in front of Vercel?](https://vercel.com/kb/guide/cloudflare-with-vercel?from=related) — Information on using Cloudflare together with Vercel. - [Can I use a proxy on top of my Vercel Deployment?](https://vercel.com/kb/guide/can-i-use-a-proxy-on-top-of-my-vercel-deployment?from=related) — General information about using an external proxy to serve a Vercel Deployment. Full cross-link map for this page: [/kb/guide/how-to-allowlist-deployment-ip-address.graph.md](/kb/guide/how-to-allowlist-deployment-ip-address.graph.md) Many external services, such as databases and corporate APIs, only accept connections from a pre-approved list of IP addresses. By default, Vercel routes outbound requests from your builds and [Vercel Functions](https://vercel.com/docs/functions) through a dynamic range of IP addresses, so there's no fixed address to add to that allowlist. Vercel gives you two ways to solve this with stable, static IP addresses: 1. [Static IPs](https://vercel.com/docs/networking/static-ips) for Pro and Enterprise teams 2. [Secure Compute](https://vercel.com/docs/networking/secure-compute) for Enterprise teams that need a dedicated private network. This guide covers how each one works and how to get started. ## Why can't you allowlist a Vercel deployment's IP by default? The IP address a service sees when your deployment connects to it is an outbound, or egress, address. Vercel assigns these addresses from a shared, dynamic pool that can change between requests, which is what keeps the platform fast and elastic. That elasticity is the tradeoff for allowlisting: - **Dynamic egress:** Outbound requests from builds and Vercel Functions can leave from any address in the pool, so you can't predict which IP your backend will see. - **No single address to approve:** Because the address changes, there's nothing stable to add to a firewall rule or access control list. To connect to an IP-restricted service, you need to pin your deployment's outbound traffic to a fixed set of addresses. That's what Static IPs and Secure Compute handle. ## Choosing between Static IPs and Secure Compute for IP allowlisting Both features give your deployment stable egress IPs, but they differ in isolation and plan availability: - **Static IPs (Pro and Enterprise):** Static egress IPs in a Virtual Private Cloud (VPC) that Vercel shares across a small group of customers, with subnet-level isolation between them. - **Secure Compute (Enterprise only):** Static egress IPs in a dedicated VPC used by no other customer, with support for VPC peering and full network isolation. Available as an Enterprise add-on with custom pricing. Choose Static IPs when you need a predictable IP for allowlisting and don't require dedicated infrastructure. Choose Secure Compute when your compliance or networking requirements call for a private network or a peered connection to your own cloud. ## How to allowlist a deployment with Static IPs (Pro and Enterprise) Static IPs route outbound traffic from your Vercel Functions through a consistent pair of static IP addresses for each region you enable. This is the most direct way to get a stable address to add to a backend service's allowlist. ### How Static IPs work Static IPs run on infrastructure Vercel manages for you: - **Shared VPC:** Your project uses a Vercel-managed VPC shared with a small group of other customers. - **Subnet-level isolation:** Logical isolation keeps traffic separate between customers on the same VPC. - **Regional IP pairs:** You enable Static IPs per region, and each region gets its own pair of static IPs. - **NAT gateway:** Traffic exits through a managed NAT gateway so the outbound address stays consistent. Static IPs apply to Vercel Functions by default, and you can extend them to build traffic if your app calls data sources at build time. They do not apply to [Routing Middleware](https://vercel.com/docs/routing-middleware), which runs at the edge before a request completes. ### How to set up Static IPs You enable Static IPs from your project's networking settings: 1. Open your project and go to **Settings**. 2. Navigate to the **Networking** tab and find the **Static IPs** section. 3. Select the region or regions closest to your backend services. 4. Copy the static IP pair Vercel provides for each region. 5. Add those IP addresses to the allowlist of your external service, such as your database or API provider. To also route build-time requests through the static IPs, enable **Use Static IPs for builds** in the same section. This setting is off by default. Turning it on means both build and function traffic count as Private Data Transfer. For a full walkthrough, see the [Static IPs documentation](https://vercel.com/docs/networking/static-ips). ## How to get dedicated deployment IPs with Secure Compute (Enterprise) Secure Compute places your builds and Vercel Functions inside a dedicated private network with a static IP pair that no other customer shares. Use it when shared infrastructure isn't enough for your security or compliance needs. ### How Secure Compute works When you enable Secure Compute on a project, you get a private network provisioned in a region you choose: - **Dedicated VPC:** Your deployments run in a private network isolated from every other customer. - **Static IP pair and NAT gateway:** The network provides a fixed IP pair for outbound traffic that won't change. - **VPC peering support:** You can peer the network directly with your own AWS VPC for private connectivity. Secure Compute applies to Vercel Functions on the Node.js, Python, and Ruby runtimes, plus build traffic when you include the build container. It does not support the Edge runtime, so Routing Middleware and functions using the Edge runtime won't use the dedicated IPs. If a project has both Secure Compute and Static IPs enabled, Static IPs are ignored. ### How to set up Secure Compute Secure Compute is an Enterprise add-on. If you don't see the option to create a network, contact your Vercel account team. Once the option is enabled, you can manage networks yourself from the dashboard: 1. Go to your team's **Settings** and open the **Networking** tab. 2. Click **Create Network**, then select the **Region** closest to your backend for the best performance. 3. Optionally expand **Advanced options** to set a custom CIDR address block or specific availability zones, then create the network. 4. Open your project's **Settings** and **Networking** tab, and connect the network to each environment by selecting an **Active Network**. Enable **Include Builds** to route build traffic through it too. 5. Copy the dedicated IP pair and add it to the access control list of your backend service. Always pair the IP allowlist with another authentication method, such as a username and password or an authentication key. The IP filter alone isn't enough to secure your backend. ### Connect to your own cloud with VPC peering If dedicated IPs aren't enough and you need a private connection to AWS infrastructure, [Secure Compute supports VPC peering](https://vercel.com/docs/networking). Peering links your Secure Compute network directly to your AWS VPC, so traffic between them stays off the public internet and doesn't incur data transfer charges. To set it up, you create a Secure Compute network with a CIDR block that doesn't overlap your AWS VPC, configure the peering connection in AWS using the values from your network settings, accept the connection in the Vercel dashboard, and update your AWS route tables. A single network supports up to 50 VPC peering connections. See the [Secure Compute documentation](https://vercel.com/docs/networking/secure-compute) for the complete peering steps. ## Next steps Once you've picked a solution, follow the setup steps for your plan and add the IPs to your backend's allowlist. To go deeper, read the [Static IPs guide](https://vercel.com/docs/networking/static-ips) or [contact the Vercel sales team](https://vercel.com/contact/sales) to enable Secure Compute for your organization. If you don't have a deployment yet, [start a new Vercel project](https://vercel.com/new) or [browse the templates](https://vercel.com/templates) to get one running first, then configure its outbound IPs using the steps above. ## Related resources - [Static IPs](https://vercel.com/docs/networking/static-ips) - [Secure Compute](https://vercel.com/docs/networking/secure-compute) - [Hosting your API on Vercel](https://vercel.com/kb/guide/hosting-backend-apis) - [Vercel Functions](https://vercel.com/docs/functions) - [Builds](https://vercel.com/docs/builds) ## Frequently asked questions ### Can I use Static IPs and Secure Compute at the same time? Not together on one project. If a project has both Secure Compute and Static IPs enabled, Vercel ignores the Static IPs and routes traffic through the dedicated Secure Compute network instead. Use Static IPs for shared infrastructure, or Secure Compute when you need a dedicated, isolated network. ### Does IP allowlisting work with Routing Middleware? No. Static IPs and Secure Compute apply to Vercel Functions and build traffic, but not to Routing Middleware. Middleware runs at the edge before a request completes, so its outbound traffic doesn't route through your static or dedicated IP addresses. ### Do Static IPs give my deployment a fixed inbound IP? No. Static IPs and Secure Compute assign fixed outbound (egress) addresses so external services can allowlist your deployment. They don't provide a fixed public address for inbound traffic, so you can't use them to make your app reachable at a single static IP.