Static IP guide

Making API requests with a static IP from a Node app on Cloudflare Workers

Cloudflare's own documentation confirms a Worker's outbound connections come from IPs outside its published ranges, so there's no static address on Cloudflare's side to hand an API partner for allowlisting. Store your Fixie proxy URL as a Worker secret and pass it into fetch(), and every request leaves from the same fixed pair of addresses no matter which of Cloudflare's edge locations handled it.

RuntimeNode.js and JavaScript
PlatformCloudflare Workers
DestinationAPI allowlisting
Fixie productFixie HTTP/S proxy

Recommended setup

Use Fixie HTTP/S proxy for HTTP and HTTPS requests to an API, webhook provider, or service that allowlists outbound IP addresses. Store the proxy value in FIXIE_URL, then configure Node.js to route outbound traffic through Fixie before connecting to API allowlisting.

Set up Fixie on Cloudflare Workers

Create a Fixie HTTP/S proxy in the Fixie dashboard. Copy the proxy value into Worker secrets as FIXIE_URL, and copy the outbound IPs into the destination allowlist.

Implementation

The example below shows the core application-side change. Keep credentials in environment variables and avoid committing proxy, database, or API secrets.

Make an HTTP request through FIXIE_URL

const axios = require('axios');

const fixieUrl = new URL(process.env.FIXIE_URL);

axios.get('https://api.example.com/data', {
  proxy: {
    protocol: 'http',
    host: fixieUrl.hostname,
    // URL drops default ports, so fall back to 80 for Fixie's standard proxy port.
    port: Number(fixieUrl.port) || 80,
    auth: {
      username: fixieUrl.username,
      password: fixieUrl.password,
    },
  },
}).then((response) => {
  console.log(response.status);
});

Good to know

  • Wrangler sets the secret with wrangler secret put FIXIE_URL; the dashboard's Settings → Variables and Secrets panel does the same thing if you'd rather not use the terminal.
  • This pattern covers fetch()-based HTTP requests through Fixie's HTTP/S proxy. A raw TCP connection (for example, to a database) needs the connect() API routed through Fixie's SOCKS proxy instead.

Allowlist and test the static IPs

  1. Open the Fixie dashboard and copy the outbound IP addresses for this proxy.
  2. Add both IPs to the API provider.
  3. Deploy the updated Node.js app on Cloudflare Workers.
  4. Run a small connection test before sending production traffic.

Related guides

Related docs

Is this guide useful?