Static IP addressed for Supabase Edge functions. Possible?

[MariusWilsch]

Hello my client has recently implemented a VPN and I can only access his API resources if I have a static IP that he can whitelist. I was using edge function so far but right now I'm clueless how retrieve the server's IP and if it's static or not.

As soon as I know the IP of the Edge Functions server, then I can whitelist that IP address and my Edge Function is usable again. I know you can print the client's IP address but that's not helping. Please let me know if that is possible at all or if I need to be looking into other hosting methods.

[tadhglewis]

Edge Functions use Deno Deploy under the hood. As far as I know, no they're not static.

Even if they were static, these IPs are shared and therefore allowlisting them inherently means you're API is insecure as anyone using Edge Functions could access it.

You should sign your requests instead using something like HMAC or similar.

[MariusWilsch]

What do you mean by sign your reuqests? Please eleborate

[tadhglewis]

Depending on your security requirements, you can either

1. Just a simple secret header which you then check on the receiving end OR
2. Implement HMAC request signing as mentioned above. There are a bunch of tutorials online which explain it better than I will be able to.

E.g. https://stackoverflow.com/questions/65805172/how-to-create-and-verify-a-hash-with-hmacsha256-in-deno

and https://developers.mekari.com/docs/kb/hmac-authentication/node but this is for node, you'd need to use the equivalent APIs

[bytaesu]

You can utilize other services depending on specific requirements to customize features (for example, things like rate limiting).
Consider placing something like AWS API Gateway in front of Supabase Edge Functions.

[tmikulin]

for that use cause you can you use a static outbound ip proxy, e.g. https://outboundgateway.com