Documentation +

Static IP guide

Making API requests with a static IP from a Java app on Heroku

Java apps on Heroku route OkHttp or Apache HttpClient traffic through Fixie by parsing FIXIE_URL into host, port, and credentials and registering a proxy authenticator. The JVM-wide alternative (https.proxyHost system properties) works too, but needs one extra flag most people miss.

RuntimeJava
PlatformHeroku
DestinationAPI allowlisting
Fixie productFixie HTTP/S Heroku add-on

Recommended setup

Use Fixie HTTP/S Heroku add-on for HTTP and HTTPS requests to an API, webhook provider, or service that allowlists outbound IP addresses. Store the proxy value in FIXIE_URL, then configure Java to route outbound traffic through Fixie before connecting to API allowlisting.

Set up Fixie on Heroku

Heroku is a native Fixie marketplace flow. Install the Fixie HTTP/S Heroku add-on or attach it from the Heroku CLI. Heroku will create FIXIE_URL as a config var for the app.

Attach fixie to your Heroku app

heroku addons:create fixie
heroku config:get FIXIE_URL

Implementation

The example below shows the core application-side change. Keep credentials in environment variables and avoid committing proxy, database, or API secrets.

Make an HTTP request through FIXIE_URL

String fixieUrl = System.getenv("FIXIE_URL");
String[] fixieValues = fixieUrl.split("[/(:\\/@)/]+");

String fixieUser = fixieValues[1];
String fixiePassword = fixieValues[2];
String fixieHost = fixieValues[3];
int fixiePort = Integer.parseInt(fixieValues[4]);

OkHttpClient client = new OkHttpClient.Builder()
    .proxy(new Proxy(Proxy.Type.HTTP, new InetSocketAddress(fixieHost, fixiePort)))
    .proxyAuthenticator((route, response) -> {
        String credential = Credentials.basic(fixieUser, fixiePassword);
        return response.request().newBuilder()
            .header("Proxy-Authorization", credential)
            .build();
    })
    .build();

Good to know

  • Since Java 8u111 the JVM disables Basic authentication for HTTPS tunneling; if you use system-property proxying, clear jdk.http.auth.tunneling.disabledSchemes or the proxy will return 407s.
  • With OkHttp, build one client and reuse it — the proxyAuthenticator is attached at client construction, not per request.

Allowlist and test the static IPs

  1. Open the Fixie dashboard and copy the outbound IP addresses for this proxy.
  2. Add both IPs to the API provider.
  3. Deploy the updated Java app on Heroku.
  4. Run a small connection test before sending production traffic.

Related guides

Related docs