Quick answer
How do I allowlist a static proxy IP?
To allowlist a static proxy IP, read the exit IP through the proxy with api.ipify.org, add that exact IP (a /32) to the destination's allowlist, then test with and without the proxy. Add a backup IP and renew before the 30-day end date. SteadyProxy also offers an allowlist in the other direction; its login options are: Username and password, or an IP allowlist (up to 10 IPs). Updated 19 October 2026.
What are the key facts?
| Two different allowlists | The destination allows your proxy's exit IP; SteadyProxy can allow your own IPs instead of a password |
|---|---|
| Which IP to add | The exit IP returned by api.ipify.org through the proxy |
| Entry format | A single address, 203.0.113.10, or 203.0.113.10/32 in CIDR tools |
| Proxy authentication | Username and password, or an IP allowlist (up to 10 IPs) |
| Rental | 30 days per IP; renew before the end date, as the same IP after it is not guaranteed |
| Backup | Add a second static IP to every allowlist that matters |
| Price | $1.34 per datacenter IP, $2.24 per ISP IP, 30 days |
What are the 5 steps to allowlist a static proxy IP?
Read the exit IP
Send a request to https://api.ipify.org through the proxy. The answer is the IP the destination will see. It can differ from the host name in your dashboard.
Add the IP to the allowlist
In the firewall, cloud network rules or SaaS admin panel, add that exact address. Use /32 where the tool asks for CIDR. Add a label with the order and end date.
Add a backup IP
Add a second static IP, ideally from another /24 or country, so a fault on one IP does not lock you out.
Test both ways
Through the proxy, the protected page should answer 200. Without the proxy, it should refuse access with 403 or time out.
Plan the renewal
Renew from your balance before the end date and re-check the exit IP after each renewal.
# Step 1 - read the exit IP the destination will see (write it down)
curl -s -m 30 -x "http://USERNAME:[email protected]:7777" https://api.ipify.org
# Step 3 - example: open HTTPS on your own Linux server to that one IP (ufw)
sudo ufw allow from 203.0.113.10 to any port 443 proto tcp
# Step 4 - test from outside: through the proxy (expect 200), then without it (expect 403 or a timeout)
curl -s -o /dev/null -w "%{http_code}\n" -x "http://USERNAME:[email protected]:7777" https://admin.example.com/
curl -s -o /dev/null -m 15 -w "%{http_code}\n" https://admin.example.com/
# nginx: only the static proxy IP may open /admin/ (inside your server { } block)
location /admin/ {
allow 203.0.113.10; # static proxy exit IP
allow 198.51.100.7; # optional second static IP, for redundancy
deny all;
}
Where do I add the IP in common tools?
The field has different names, but the content is the same: one exact IP.
- Cloud firewalls (network rules, inbound rules): add an inbound rule with the source 203.0.113.10/32 and the port you need, such as 443.
- Linux servers: ufw allow from the IP to the port, as in the example above, or the matching iptables or nftables rule.
- Web servers: nginx allow and deny lines, or the equivalent Require ip line in Apache.
- SaaS admin panels: look for IP restrictions, trusted IPs or network access in the security settings.
- Databases: PostgreSQL uses a host line with 203.0.113.10/32 in pg_hba.conf.
Replace 203.0.113.10, a documentation address, with your real exit IP.
How do I use the SteadyProxy IP allowlist instead of a password?
SteadyProxy offers two login methods for each static IP: Username and password, or an IP allowlist (up to 10 IPs). With the allowlist method, you register the public IPs of the machines that connect to the proxy, and those machines connect without a username or password. This is the simplest way to use tools that cannot send proxy credentials, such as Chrome driven by Selenium. Find the public IP of each machine with api.ipify.org without the proxy. Ask support if the option is not visible for your IPs: Email replies within 12 hours, 7 days a week. The Selenium guide shows this method in code.
What should I check at each renewal?
Check that the exit IP did not change. Renew before the end date, then run the step 1 command again. Renewal is manual, from your balance, before the end date. Keeping the same IP after the end date is not guaranteed, so renew on time and check your IP list after renewing. If the IP is different, update the allowlist before you remove the old entry. Keep a short inventory: IP, destination, allowlist entry, order and end date. Remove entries for IPs you no longer rent, so a later renter of that IP never gets your access.
Which page explains the business case for a fixed source IP?
This guide covers the steps. Why a business uses one fixed source IP for partner APIs, SaaS admin panels, firewalls and B2B portals is covered on static IP for B2B allowlisted access. For allowlisting alone, a dedicated datacenter IP works as well as an ISP IP, because the destination checks the exact address, not its network type.
What else do people ask about allowlisting a static IP?
Should I add the proxy host or the exit IP to the allowlist?
The exit IP. The host in your dashboard is where your tool connects; the exit IP is what the destination sees. They can differ. Read the exit IP through the proxy with api.ipify.org and add that address. If you add the wrong one, the test through the proxy returns 403 instead of 200.
Can I allowlist a whole /24 instead of one IP?
Avoid it. A /24 holds 256 addresses, and you rent only some of them; the others belong to other customers or networks. Allowlisting the block would open your service to all of them. Add each exact IP as a /32. If you need several IPs, list them one by one.
How many of my own IPs can I allowlist at SteadyProxy?
Up to 10. Our login options are: Username and password, or an IP allowlist (up to 10 IPs). Each entry is one of your public source IPs, such as an office line or a server. Machines with changing home IPs are a poor fit for this method; use the username and password for them instead.
What happens to my allowlist if the proxy IP is replaced?
The new IP is not on the destination's allowlist yet, so access through it fails until you add it. That is why a backup IP should already be listed. If an IP does not work, write to support: we repair it or replace it with another IP in the same country when stock allows. Update the allowlist with the new exit IP, test it, then remove the old entry.
Is the IP allowlist safer than a username and password?
It removes one secret: no proxy password travels with each connection or sits in scripts. It ties access to your machines' public IPs, so anyone sharing such an IP, for example on the same office network, can also use the proxy. Choose per IP, and keep passwords out of code repositories in either case.
Can I use one static IP for allowlists at several companies?
Yes, if the IP is used only by you or your own team. Each destination lists the same exit IP. Our allocation rule: Each static IP is rented to one customer for the whole 30-day period; reselling or sharing access with third parties is not allowed. If one destination needs strict separation, give it its own IP.
Which sites cannot be reached through the allowlisted IP?
Some targets are blocked on every IP: Banking, government, payment-portal and ticketing sites, plus SMTP (email-sending) ports 25, 465 and 587. Allowlisting a static IP on a bank or government portal will not help, because the traffic will not pass the proxy. Everything else must follow our acceptable use policy.
Which sources does this guide use? (4)
- ngx_http_access_module (allow and deny) — nginx (2026-10-19)
- The pg_hba.conf file — PostgreSQL (2026-10-19)
- RFC 5737: IPv4 Address Blocks Reserved for Documentation — IETF (2026-10-19)
- ipify API — ipify (2026-10-19)