A PaaS shared outbound IP in a partner allow-list stops working days later
Deploy and infrastructure
Symptom
A partner API enforces a caller IP allow-list. You register your outbound IP, it works for days, then one day it's blocked again. Nothing in the code changed, so it presents as "what worked yesterday doesn't today" and takes a long time to trace.
Cause
The address you registered was the PaaS's shared outbound IP. It's a shared range; the provider changes it, and on that day the allow-list is wrong. The admin screen was displaying that IP as a hardcoded value, so the operator trusted it and registered it.
Fix
- Route IP-gated partners through one fixed-IP relay and register only that one IP.
- Distinguish routes that go via the relay from direct ones. Writing the relay IP for a partner you call directly is the wrong answer — that side needs every PaaS outbound IP or a different arrangement. And some partners require API access approval before the IP even matters; unapproved, a valid key is still rejected.
- Derive the outbound IP shown on screen from config, never hardcode it (config value → relay URL host → DNS, in that order). When unknown, return blank so the screen says "could not determine."
- Keep the "does this partner go via the relay" decision in one place. Re-deciding it in the UI guarantees the two diverge.
Verification
One real call per route: relay partners through the relay, direct partners straight from the PaaS. Change the config and confirm the displayed IP follows it.
★ Never hand out "the IP that works today." Only an IP that is the same tomorrow.