Setting Up a Static Outbound IP on Google Cloud for Kite Connect Whitelisting

When working with trading APIs like Kite Connect by Zerodha, one common requirement is IP whitelisting. This means your backend must always hit their APIs from a fixed public IP address.

If you’re deploying on Google Cloud, this is not straightforward by default. Here’s how we set up a static outbound IP using VPC, Cloud Router, and Cloud NAT.

Objective

• Kite Connect requires a fixed IP for API access
• Need a reliable and scalable way to enforce a static IP

Solution Overview

We’ll configure:

1. VPC Network
2. Cloud Router
3. Static External IP
4. Cloud NAT
5. Serverless VPC Connector

This ensures all outbound traffic routes through a single static IP.

Step 1: Verify VPC Network

Check your existing VPC:

gcloud compute networks list

Output:

NAME     SUBNET_MODE  BGP_ROUTING_MODE
default  AUTO         REGIONAL

We’ll use the default network.

Step 2: Create a Cloud Router

gcloud compute routers create ROUTER_NAME \
  --network=NETWORK_NAME \
  --region=REGION

In the command above, replace:

ROUTER_NAME with a name for the Cloud Router resource you want to create.
NETWORK_NAME with the name of the VPC network you found in step 1.
REGION with the region in which you want to create a NAT gateway.

Verify:

gcloud compute routers list

This router is required for NAT configuration.

Step 3: Reserve a Static IP Address

gcloud compute addresses create ORIGIN_IP_NAME --region=REGION

In the command above, replace:

ORIGIN_IP_NAME with the name you want to assign to the IP address resource.
REGION with the region that will run the Cloud NAT router. Ideally the same region as your Cloud Functions to minimize latency and network costs.

This IP Address is what you’ll whitelist in Kite Connect.

Get EkamTek Software’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Step 4: Create Cloud NAT

gcloud compute routers nats create NAT_NAME \
  --router=ROUTER_NAME \
  --region=REGION \
  --nat-all-subnet-ip-ranges \
  --nat-external-ip-pool=ORIGIN_IP_NAME

In the command above, replace:

NAT_NAME with a name for the Cloud NAT gateway resource you want to create.
ROUTER_NAME with the name of your Cloud Router.
REGION with the region in which you want to create a NAT gateway.
ORIGIN_IP_NAME with the name of the reserved IP address resource you created in the previous step.

What this does:

• Routes all outbound traffic through NAT
• Uses your reserved static IP
• Applies to all subnets

Step 5: Create a Serverless VPC Connector

Create connector using this link

This connector allows services like:

• Cloud Run
• Cloud Functions

to route traffic through the VPC (and hence NAT).

The last step is to attach connector to your service.

Final Result

All outgoing requests now originate from:

• IP Address
• Add this IP to Kite Connect whitelist
• Your API calls will now work reliably

Conclusion

This setup ensures:

• Stable outbound IP
• Compatibility with Kite Connect whitelist
• Scalable architecture for production workloads

If you’re building trading systems or working with strict API providers, this pattern is almost mandatory on GCP.