A Static Outbound IP for Vercel
Vercel sells Static IPs at $100/month per project on Pro and Enterprise, and its documentation is clear that the addresses are shared with a small group of other customers in the same region. That is the right purchase for most people: it is first-party, it covers function and build traffic automatically, and it is far less work than anything else here. It is worth comparing carefully only in two cases — when a reviewer will ask who else holds the address, and when you have several projects.
Why the address moves by default
Vercel Functions run on managed, ephemeral infrastructure across regions. Outbound traffic leaves from address pools Vercel operates, and there is nothing stable for you to hand a partner. This is the normal state for every serverless platform and it is not a defect — it is what makes the platform elastic.
Vercel's own answer, read from their documentation
Vercel offers two things, and the distinction matters:
- Static IPs — Pro and Enterprise. Fixed egress addresses for your project's functions, and optionally its builds. Vercel's table lists the IP type as “Static in shared Virtual Private Cloud” with “shared VPC for a small group of customers with subnet-level isolation”, and the limits section states plainly that “Static IP addresses are shared across a small group of customers in the same region”. Priced at $100/month per project, plus Private Data Transfer at regional rates.
- Secure Compute — Enterprise only. A dedicated VPC and subnet per customer, with VPC peering and full isolation. Custom pricing.
Read from Vercel's Static IPs documentation on 2026-09-17; that page carried a last-updated date of 2026-06-30. Check it yourself before budgeting — we do not control their pricing and it changes.
Two limits worth knowing before you buy, both from the same page: Static IPs are egress only — they do not give your app a fixed inbound address — and they do not apply to middleware, which runs at the edge. If the call you need allow-listed is made from middleware, this product does not cover it.
When Vercel's Static IPs are the right buy — which is often
We would rather say this than have you discover it after paying us:
- One project, and a shared address is acceptable. Most vendor allow-lists do not ask who else is behind an address. If yours does not, Vercel's product is one toggle and no machine to run.
- You want all function and build traffic covered. Vercel routes it for you. Our approach covers the specific calls you deliberately send through the address, which is more control and more work.
- You are already on Enterprise with Secure Compute. Then you have a dedicated VPC already and nothing on this page improves on it.
The two cases where an address you hold wins
A reviewer asks who else uses the address. “Shared with a small group of customers” is honest and adequate for most integrations. For a bank, a payment processor, or a security questionnaire that asks whether the source address is exclusive to you, the answer has to be no. A dedicated address from 23.187.152.0/24, announced by AS396500, is yours alone and nobody else's traffic can ever appear to come from it. Reputation works the same way — a shared address carries other people's behaviour.
You have more than one project, or more than one platform. Vercel's pricing is per project. Three projects needing the same allow-list entry is $300/month, and the partner still has to allow-list three sets of addresses. One dedicated address is one entry, one price, and the same address whether the call comes from Vercel, from a container platform next quarter, or from a server in your office. Static IPs are tied to the project; an address you hold travels.
How it works in practice
Attach a TunnelNet address to a small always-on box (a $5 VPS, a machine you already own) and have the function make the allow-listed call through it. The rest of your deployment is untouched and stays on Vercel exactly as it is.
Two honest caveats:
- You are adding a hop and a machine you keep running. Vercel operates theirs. On a platform chosen so that you do not run machines, that is a genuine argument against this approach, and for a single project it is usually the deciding one.
- It covers named calls, not all egress from the project, and it does not help with middleware either.
Verify the source address before you file it
Whichever route you take, do not send the partner the address you configured. Send the address a remote server actually sees, from the code path that will really make the call:
curl -4 https://api.ipify.org
Run it from the function itself, or from the box the function calls through, and check it a second way (curl -4 https://ifconfig.co). If you enabled Static IPs, confirm the build path separately — routing build traffic through them is a toggle that is off by default, so a data source called at build time can still be reached from an address you never filed.
What this costs with us
A dedicated address is $20/month on TunnelNet Full, inbound and outbound on the same address, attached to a machine you already have. TunnelNet Business is $100/month for the same address with a written 8-working-hour response commitment (09:00–17:00 US Central, Monday to Friday), onboarding done with a person who verifies the source address from outside our network before you file it, and our measured uptime published — incidents included.
Plainly, because you are about to put a partner integration on this: we have no SLA and will not offer one until we have six months of measured history, 21 February 2027 at the earliest. A hub failure that withdraws routes takes about 25 seconds to recover, measured — and a hub that stays up while it stops forwarding is not failed over automatically at all. Vercel will quote you better availability numbers than that, and they will be true. Weigh it against what the address itself is worth to you.
Static IP for your platform
The same question, answered for each platform it comes up on most. Every one of them leads with that platform's own native or free answer:
- AWS Lambda — VPC and NAT Gateway, and what that really costs
- Netlify Functions — no list exists — what to try before building anything
- Supabase Edge Functions — Supabase documents that there is no static egress IP
- Heroku — Private Spaces, proxy add-ons, or an address you hold
- Render — shared by default, genuinely dedicated on Pro
- Railway — a Pro-plan toggle, and the “may be shared” caveat
- GitHub Actions — larger runners, or the free self-hosted answer
- Zapier — included on Professional, absent on Free
And the general case, if your platform is not listed: