FixedmarkStarter
For side projects.
$9/mo
- Shared IP pair
- 20 GB bandwidth
- No request cap
- HTTP, SOCKS5, and tunnel CLI
- Usage alerts
FIXEDMARK · STATIC IP PROXY · EARLY ACCESS
Dedicated static outbound IPs for Vercel, Railway, Render, and other serverless apps.
Fixedmark sends your app's outbound traffic from two fixed IPv4 addresses reserved for you. Allowlist them once in MongoDB Atlas, a partner API, or a customer's firewall. Keep deploying where you deploy now.
Not live yet. Planned pricing: free tier, dedicated IP pair from $29/mo, with no request cap. QuotaGuard's dedicated IPs start at $219/mo.
App
Worker
Workflow
203.0.113.24
FixedmarkAllowed
outbound IP
outbound IP
API
Database
Partner service
Why Fixedmark
How Fixedmark's planned launch compares with QuotaGuard, Fixie, and an AWS NAT Gateway.
Dedicated IPs for $29/mo
The planned Pro plan includes a dedicated IP pair. QuotaGuard's cheapest dedicated-IP plan is $219/mo, per its pricing page in October 2026.
Compare with QuotaGuardHTTP and SOCKS5 in one plan
Call APIs over HTTP CONNECT and reach databases over SOCKS5 with the same IPs. Fixie sells HTTP and SOCKS5 as separate subscriptions.
Compare with Fixie10 regions at launch
Singapore, Jakarta, Tokyo, Sydney, Frankfurt, New York, and Virginia, plus Mumbai, Chennai, and Bangalore in India. Put your IPs next to the database or API you call.
All planned regionsZero-knowledge on every plan
TLS passes through end to end and is never decrypted. The proxy endpoint itself uses TLS, so your proxy credentials are never sent in cleartext.
How the proxy handles TLSNo NAT Gateway bill
An AWS NAT Gateway only works for compute in your own VPC. Two of them cost about $73/mo in us-east-1 before any traffic.
NAT Gateway cost calculatorOne IP per customer, for platforms
Planned for platforms that call partner APIs for many clients, such as algo trading platforms, payout fintechs, and e-invoicing integrators: a dedicated IP per tenant, priced per IP at volume.
Talk to us about volume
What is Fixedmark?
Fixedmark is a static outbound IP proxy for serverless and PaaS apps. Your app sends HTTP, HTTPS, and SOCKS5 traffic through one proxy URL. Every request leaves from the same pair of IPv4 addresses. Allowlist the pair once. It stays the same across deploys, scaling, and platform moves.
- 01
Allowlist once
Give MongoDB Atlas, partner APIs, and customer firewalls one IP pair. It does not change when you redeploy.
- 02
Keep your stack
Stay on Vercel, Railway, Render, Fly.io, Supabase, or Heroku. Add one environment variable.
- 03
Reach protected services
Connect to IP-restricted APIs over HTTPS and to databases like Postgres and MongoDB over SOCKS5.
How it works
Get a static outbound IP in three steps.
- 01
Create your endpoint
Pick the region nearest your database or API, such as Virginia or Frankfurt, and get your IP pair.
- 02
Configure your proxy
Set FIXEDMARK_PROXY_URL and pass it to your HTTP client.
- 03
Allowlist your IPs
Add both IPs to the service you are connecting to.
curl --proxy "$FIXEDMARK_PROXY_URL" \
https://api.example.com/v1/statusimport { fetch, ProxyAgent } from "undici";
const dispatcher = new ProxyAgent(process.env.FIXEDMARK_PROXY_URL);
const res = await fetch("https://api.example.com/v1/status", {
dispatcher,
});
console.log(res.status);import os
import requests
proxy = os.environ["FIXEDMARK_PROXY_URL"]
res = requests.get(
"https://api.example.com/v1/status",
proxies={"http": proxy, "https": proxy},
)
print(res.status_code)// Run with: HTTPS_PROXY="$FIXEDMARK_PROXY_URL" go run .
package main
import (
"fmt"
"net/http"
)
func main() {
client := &http.Client{
Transport: &http.Transport{Proxy: http.ProxyFromEnvironment},
}
res, err := client.Get("https://api.example.com/v1/status")
if err != nil {
panic(err)
}
defer res.Body.Close()
fmt.Println(res.Status)
}One proxy URL.
HTTP or SOCKS5.
Set FIXEDMARK_PROXY_URL and pass it to your HTTP client. Use HTTP CONNECT over a TLS proxy endpoint for APIs. Use SOCKS5 for databases and other TCP services.
When you need a static IP
Common reasons teams need a fixed outbound IP.
MongoDB Atlas
Replace 0.0.0.0/0 in your Atlas access list with two fixed IPs.
Partner API allowlisting
Give partners one IP pair to allowlist, whatever platform you deploy on.
Postgres and MySQL
Connect to IP-restricted databases over SOCKS5 or the tunnel CLI.
Leaving Heroku
Move off Heroku and its IP add-ons without asking partners to update allowlists.
AI agents and automations
Keep agents, cron jobs, and n8n workflows on a consistent IP.
Indian payout, UPI, and GST APIs
Whitelist a dedicated Mumbai IP pair with your payout bank, UPI partner bank, or GSP.
Planned for launch
Nothing is live yet. These features are planned for the first public version. Some depend on the plan.
Dedicated IP pairs
Two static IPv4 addresses reserved for your account only, load-balanced for high availability. Allowlist both once.
HTTP, HTTPS, and SOCKS5 in one plan
HTTP CONNECT for APIs and SOCKS5 for databases, SSH, and any TCP service. One subscription, one set of IPs.
Zero-knowledge by default
TLS passes through end to end and is never decrypted. A TLS-wrapped proxy endpoint keeps your proxy credentials off the wire in cleartext.
Regions near your APIs
The US, Frankfurt, Singapore, Tokyo, Sydney, and Jakarta, plus Mumbai, Chennai, and Bangalore in India. Put your IPs next to the database or API you call.
Connection logs
See destination, SNI, bytes, egress IP, and result for every connection, so allowlist errors are easy to debug.
Destination allowlists
Restrict each token to the hosts and ports it needs, such as api.razorpay.com:443. A leaked token cannot reach anything else.
bm tunnel CLI
Forward local ports to IP-restricted databases for drivers without proxy support. Works from a local config file with no startup API call.
Usage alerts and webhooks
Soft limits with alerts before you hit them, plus webhooks for quota and IP health events.
Dashboard preview
Planned dashboard: your IPs, proxy URL, and usage in one place.
Interactive preview with example data and documentation-only IP addresses. It does not connect to a live account.
Regions near the APIs you call
Planned launch regions: Singapore, Jakarta, Tokyo, Sydney, Frankfurt, New York, Virginia, Mumbai, Chennai, and Bangalore. Pick the region nearest the API or database you call.
- SingaporeSingaporeAT LAUNCH
- JakartaIndonesiaAT LAUNCH
- TokyoJapanAT LAUNCH
- SydneyAustraliaAT LAUNCH
- FrankfurtGermanyAT LAUNCH
- New YorkUnited StatesAT LAUNCH
- VirginiaUnited StatesAT LAUNCH
- MumbaiIndiaAT LAUNCH
- ChennaiIndiaAT LAUNCH
- BangaloreIndiaAT LAUNCH
Planned pricing
In USD per month. You pay for bandwidth, never per request. Subject to change before launch.
ProRecommended
For production apps.
$29/mo
- Dedicated IP pair, 1 region
- 200 GB bandwidth
- No request cap
- 7-day connection logs
- Webhooks
Business
For teams with compliance needs.
$79/mo
- Dedicated IP pairs, 2 regions
- 1 TB bandwidth
- No request cap
- Destination allowlists
- 30-day connection logs
- Priority support
Free and Scale plans are also planned. Compare all planned plans
Static IP
questions
What is Fixedmark?
Fixedmark is a static outbound IP proxy for serverless and PaaS apps, operated by BitMask LLP. Your app sends outbound requests through a Fixedmark proxy URL, and they leave from two fixed IPv4 addresses that you allowlist once. It is in early access and not yet live.
What is a static outbound IP?
It is the fixed public address other services see when your app makes a request. By default, serverless and PaaS platforms send traffic from shared IPs that change, so a database like MongoDB Atlas, a partner API, or a customer's firewall cannot allowlist them. A static outbound IP stays the same across deploys.
How do I get a static IP for Vercel, Heroku, or Railway?
Route the requests that need a fixed IP through a proxy. With Fixedmark, set FIXEDMARK_PROXY_URL as an environment variable, pass it to your HTTP client, and add your two Fixedmark IPs to the destination's allowlist. The same setup works on Render, Supabase Edge Functions, Fly.io, and AWS Lambda.
How is Fixedmark different from QuotaGuard, Fixie, or an AWS NAT Gateway?
Fixedmark plans a dedicated IP pair on the $29/mo Pro plan. QuotaGuard's cheapest dedicated-IP plan is $219/mo. Fixie sells HTTP and SOCKS5 as separate subscriptions; Fixedmark includes both in one plan. A NAT Gateway only works inside your own AWS VPC, and two of them cost about $73/mo before traffic.
What is the difference between dedicated and shared static IPs?
A shared IP is used by several customers, so anyone on it passes the same allowlist. A dedicated IP is reserved for your account. On the planned plans, Free and Starter use a shared IP pair. Pro and above use a dedicated pair, which partners with strict security reviews often require.
Does Fixedmark work for databases like Postgres, MySQL, and MongoDB?
Yes. Every plan includes SOCKS5, which carries any TCP connection, including Postgres, MySQL, MongoDB Atlas, Redis, and SSH. For drivers without proxy support, the bm tunnel CLI on paid plans forwards a local port to the IP-restricted database.
Does Fixedmark decrypt my traffic?
No. HTTPS passes through as an encrypted TLS tunnel from your app to the destination, so Fixedmark never sees request bodies, headers, or API keys. Connection logs record metadata only: destination host, SNI, bytes, egress IP, and result.
Can I get a separate IP for each of my customers?
That is planned for platforms that call partner APIs on behalf of many clients, such as algo trading platforms, payout fintechs, and e-invoicing integrators. Each tenant gets its own dedicated IP, priced per IP at volume. Email us to discuss your setup.
Is Fixedmark available now?
No. Fixedmark is in early access and not generally available. Join the early access list to get an endpoint when your region opens. Pricing is planned and may change before launch.
Make it fixed.
Fixedmark is in early access. Join the list to get a dedicated static IP pair when your region opens.