You only need a static IP for the environments/services that actually make outbound requests to that API.

In Railway, the Static IP feature is an outbound IP for a specific service. So:

• If only production calls the whitelisted API, enable Static IP only on the production service and whitelist that IP.
• If both production and testing call the API, enable Static IP on both and whitelist both IPs.
• If production and testing are separate environments with separate deployments, don’t assume they will share the same outbound IP.

You can enable it from the service’s Settings → Networking → Enable Static IPs. After enabling it, redeploy the service, then use the shown IPv4 address for the API whitelist.

So in your case: one IP is enough only if one environment needs access. If both production and testing need access, use two static outbound IPs and whitelist both.