Backfire vs QuotaGuard
Backfire compared with QuotaGuard
These two get compared because both sit between your code and someone else's API. QuotaGuard answers a question about your source address: route this app through us and it will always arrive from the same IP, which you can hand to a partner who screens callers. Backfire answers a question about your destination: is this URL allowed to be called at all, and can you prove afterwards what happened.
Which one you actually need
If a partner must allowlist a source IP before they will talk to you, buy the static-IP proxy — Backfire has no IP to give and will not pretend to. If the risk is the URL rather than the caller, a fixed IP changes nothing about it, and the relay is the shorter path.
Job it does
- QuotaGuard
- One stable outbound IP for your app
- Backfire
- One guarded, metered, logged call
Exit identity
- QuotaGuard
- A dedicated static IP you can hand to a partner
- Backfire
- Shared relay infrastructure, attributable to your key
Target allowlisting
- QuotaGuard
- Not the product
- Backfire
- Every address checked after DNS, refused if private
How you call it
- QuotaGuard
- Your HTTP client is routed through a proxy URL
- Backfire
- One JSON POST to the forward endpoint
Per-call record
- QuotaGuard
- Request logs and quota counters
- Backfire
- Method, target, status, bytes, duration, error code — exportable
Refusals
- QuotaGuard
- Network-level failures
- Backfire
- A code, a reason and a log line, never charged
Contract shape
- QuotaGuard
- Ongoing subscription with a plan ceiling
- Backfire
- Prepaid trips, no subscription, no expiry
Where it fits
- QuotaGuard
- Runtimes that need a fixed egress address
- Backfire
- Any runtime that can send an HTTPS POST
Side by side
# Static-IP proxy: the source address is the product
HTTPS_PROXY=http://user:pass@static.proxy.example:9293 curl https://api.partner.example/v1/orders
# Backfire: the destination is the product — an IP literal is refused
POST /functions/forward
{ "url": "http://169.254.169.254/latest/meta-data/" }
# → 403 blocked_target, logged, no trip chargedWhere the other one wins
- A fixed IP answers "who is calling". It does not answer "what did we call, was it allowed, and what came back" — which is the question an incident review actually asks.
- Backfire egresses from shared relay infrastructure. If your partner insists on a per-customer address, that is a legitimate requirement and this is the wrong product for it.
- The two coexist comfortably: a static IP for the one partner that demands it, the relay for the URLs your users, your models and your webhooks hand you.
- Neither replaces an egress policy inside your own VPC. That is a network control; both of these are application controls.
What Backfire will not do
- No static, dedicated or per-customer outbound IP — and no way to pin one.
- No HTTP CONNECT or SOCKS mode: it is a JSON forward, not a proxy URL for an HTTP client.
- A partner that screens source addresses will refuse the relay, correctly.
- One trip per completed roundtrip; a refusal before the call is free.
Other comparisons
Questions about this
Related reading
Try it with 5,000 free trips.
No card, no subscription, and the balance never expires.