With Fixie static IP, your Cloudflare Workers can send any (HTTP, HTTPS, Database, TCP, and more) outbound requests from a fixed set of static IP addresses. Fixie for Cloudflare Workers is language- and framework-agnostic.

Workers run on Cloudflare's edge, handling each request at whichever of Cloudflare's data centers is closest to it rather than on a single long-lived server. Because a different data center can handle any given request, the outbound IP it leaves from isn't something you control and can shift from one invocation to the next. Cloudflare's own documentation confirms Workers' outbound connections are sourced from IPs outside its published ranges, so there's no static IP to allow-list on Cloudflare's side. This makes it difficult to integrate with external services, an API, a database, a corporate firewall, that only accept traffic from an allow-listed range. Fixie sits in front of your outbound traffic instead and gives you both HTTP and SOCKS V5 proxies, so requests leave from the same pair of IP addresses no matter which edge location handled the request.

Workers support two ways to make outbound requests: the fetch() API for HTTP/S, and a connect() API for raw TCP sockets (useful for direct database connections and other non-HTTP protocols). Fixie's HTTP/S proxy works with fetch()-based requests, and Fixie's SOCKS proxy works with connect()-based TCP connections, so either approach can route through a Fixie static IP.

Fixie can be used with any backend language, including JavaScript, Ruby, Python, Java, Go, and PHP, if you're calling out to Fixie from a different part of your stack than the Worker itself.

Unlike Heroku and Vercel where there are native integrations available, Cloudflare Workers support needs to be added manually at this time.

Getting Started

To get started, create a Fixie account, and create a new Proxy Application.

After the proxy is created, go to Proxy's Details page where you'll see a couple of important values:

• Proxy URL: Your Fixie HTTP/S or SOCKS proxy URL that includes your username, password and proxy server load-balancer to use.
• Outbound IPs: Your pair of Fixie IP-addresses. These will never change, so feel free to allow-list them with firewalls or services.

Configure Your Application

Next, update your Worker to use your Fixie proxy server. If you're making an HTTP/S request, pass your Fixie HTTP/S proxy URL in your fetch() call; if you need a raw TCP connection (for example, to a database), use the connect() API with Fixie's SOCKS proxy.

Store your Fixie credentials as a Worker secret rather than hardcoding them in source. Secrets can be set with Wrangler:

wrangler secret put FIXIE_URL

Or from the dashboard:

• Open Workers & Pages, select your Worker, then click Settings.
• Find the Variables and Secrets section and click Add.
• Choose Secret as the type, enter the name (e.g. FIXIE_URL) and your Fixie proxy URL as the value.
• Click Deploy.

We recommend the following naming conventions so it's easier to follow along with our documentation:

• FIXIE_URL for your Fixie HTTP/S proxy
• FIXIE_SOCKS_HOST for your Fixie SOCKS proxy

Feel free to create different Fixie proxies for different environments (for example, a staging and a production Worker) to keep credentials and logs separate — it also makes debugging easier, since you can tell at a glance from the proxy's own request logs which Worker generated a given request, instead of digging through logs that mix staging and production together.

Local setup

To use Fixie locally with wrangler dev, add your secrets to a .dev.vars file in your project root.

Keep sensitive configuration values, like credentials, out of source control. Exclude the .dev.vars file in Git with: echo '.dev.vars' >> .gitignore.

Changing plans

Use the Fixie dashboard to change your plan. To change the plan, click Change Plan button and select an appropriate plan.

NOTE: Changing the plan won't affect your outbound IP address

Deleting a proxy

To remove the proxies, go to the Fixie dashboard and select Delete for the desired proxy.