Many external services, such as databases and corporate APIs, only accept connections from a pre-approved list of IP addresses. By default, Vercel routes outbound requests from your builds and Vercel Functions through a dynamic range of IP addresses, so there's no fixed address to add to that allowlist.
Vercel gives you two ways to solve this with stable, static IP addresses:
- Static IPs for Pro and Enterprise teams
- Secure Compute for Enterprise teams that need a dedicated private network.
This guide covers how each one works and how to get started.
Copy link to headingWhy can't you allowlist a Vercel deployment's IP by default?
The IP address a service sees when your deployment connects to it is an outbound, or egress, address. Vercel assigns these addresses from a shared, dynamic pool that can change between requests, which is what keeps the platform fast and elastic.
That elasticity is the tradeoff for allowlisting:
- Dynamic egress: Outbound requests from builds and Vercel Functions can leave from any address in the pool, so you can't predict which IP your backend will see.
- No single address to approve: Because the address changes, there's nothing stable to add to a firewall rule or access control list.
To connect to an IP-restricted service, you need to pin your deployment's outbound traffic to a fixed set of addresses. That's what Static IPs and Secure Compute handle.
Copy link to headingChoosing between Static IPs and Secure Compute for IP allowlisting
Both features give your deployment stable egress IPs, but they differ in isolation and plan availability:
- Static IPs (Pro and Enterprise): Static egress IPs in a Virtual Private Cloud (VPC) that Vercel shares across a small group of customers, with subnet-level isolation between them.
- Secure Compute (Enterprise only): Static egress IPs in a dedicated VPC used by no other customer, with support for VPC peering and full network isolation. Available as an Enterprise add-on with custom pricing.
Choose Static IPs when you need a predictable IP for allowlisting and don't require dedicated infrastructure. Choose Secure Compute when your compliance or networking requirements call for a private network or a peered connection to your own cloud.
Copy link to headingHow to allowlist a deployment with Static IPs (Pro and Enterprise)
Static IPs route outbound traffic from your Vercel Functions through a consistent pair of static IP addresses for each region you enable. This is the most direct way to get a stable address to add to a backend service's allowlist.
Copy link to headingHow Static IPs work
Static IPs run on infrastructure Vercel manages for you:
- Shared VPC: Your project uses a Vercel-managed VPC shared with a small group of other customers.
- Subnet-level isolation: Logical isolation keeps traffic separate between customers on the same VPC.
- Regional IP pairs: You enable Static IPs per region, and each region gets its own pair of static IPs.
- NAT gateway: Traffic exits through a managed NAT gateway so the outbound address stays consistent.
Static IPs apply to Vercel Functions by default, and you can extend them to build traffic if your app calls data sources at build time. They do not apply to Routing Middleware, which runs at the edge before a request completes.
Copy link to headingHow to set up Static IPs
You enable Static IPs from your project's networking settings:
- Open your project and go to Settings.
- Navigate to the Networking tab and find the Static IPs section.
- Select the region or regions closest to your backend services.
- Copy the static IP pair Vercel provides for each region.
- Add those IP addresses to the allowlist of your external service, such as your database or API provider.
To also route build-time requests through the static IPs, enable Use Static IPs for builds in the same section. This setting is off by default. Turning it on means both build and function traffic count as Private Data Transfer.
For a full walkthrough, see the Static IPs documentation.
Copy link to headingHow to get dedicated deployment IPs with Secure Compute (Enterprise)
Secure Compute places your builds and Vercel Functions inside a dedicated private network with a static IP pair that no other customer shares. Use it when shared infrastructure isn't enough for your security or compliance needs.
Copy link to headingHow Secure Compute works
When you enable Secure Compute on a project, you get a private network provisioned in a region you choose:
- Dedicated VPC: Your deployments run in a private network isolated from every other customer.
- Static IP pair and NAT gateway: The network provides a fixed IP pair for outbound traffic that won't change.
- VPC peering support: You can peer the network directly with your own AWS VPC for private connectivity.
Secure Compute applies to Vercel Functions on the Node.js, Python, and Ruby runtimes, plus build traffic when you include the build container. It does not support the Edge runtime, so Routing Middleware and functions using the Edge runtime won't use the dedicated IPs. If a project has both Secure Compute and Static IPs enabled, Static IPs are ignored.
Copy link to headingHow to set up Secure Compute
Secure Compute is an Enterprise add-on. If you don't see the option to create a network, contact your Vercel account team. Once the option is enabled, you can manage networks yourself from the dashboard:
- Go to your team's Settings and open the Networking tab.
- Click Create Network, then select the Region closest to your backend for the best performance.
- Optionally expand Advanced options to set a custom CIDR address block or specific availability zones, then create the network.
- Open your project's Settings and Networking tab, and connect the network to each environment by selecting an Active Network. Enable Include Builds to route build traffic through it too.
- Copy the dedicated IP pair and add it to the access control list of your backend service.
Always pair the IP allowlist with another authentication method, such as a username and password or an authentication key. The IP filter alone isn't enough to secure your backend.
Copy link to headingConnect to your own cloud with VPC peering
If dedicated IPs aren't enough and you need a private connection to AWS infrastructure, Secure Compute supports VPC peering. Peering links your Secure Compute network directly to your AWS VPC, so traffic between them stays off the public internet and doesn't incur data transfer charges.
To set it up, you create a Secure Compute network with a CIDR block that doesn't overlap your AWS VPC, configure the peering connection in AWS using the values from your network settings, accept the connection in the Vercel dashboard, and update your AWS route tables. A single network supports up to 50 VPC peering connections. See the Secure Compute documentation for the complete peering steps.
Copy link to headingNext steps
Once you've picked a solution, follow the setup steps for your plan and add the IPs to your backend's allowlist. To go deeper, read the Static IPs guide or contact the Vercel sales team to enable Secure Compute for your organization.
If you don't have a deployment yet, start a new Vercel project or browse the templates to get one running first, then configure its outbound IPs using the steps above.
Copy link to headingRelated resources
Copy link to headingFrequently asked questions
Copy link to headingCan I use Static IPs and Secure Compute at the same time?
Not together on one project. If a project has both Secure Compute and Static IPs enabled, Vercel ignores the Static IPs and routes traffic through the dedicated Secure Compute network instead. Use Static IPs for shared infrastructure, or Secure Compute when you need a dedicated, isolated network.
Copy link to headingDoes IP allowlisting work with Routing Middleware?
No. Static IPs and Secure Compute apply to Vercel Functions and build traffic, but not to Routing Middleware. Middleware runs at the edge before a request completes, so its outbound traffic doesn't route through your static or dedicated IP addresses.
Copy link to headingDo Static IPs give my deployment a fixed inbound IP?
No. Static IPs and Secure Compute assign fixed outbound (egress) addresses so external services can allowlist your deployment. They don't provide a fixed public address for inbound traffic, so you can't use them to make your app reachable at a single static IP.