Network Requirements & IT Allowlist

This page is for IT and security teams who manage web filtering, firewalls, or proxy allowlists. It lists every destination Circuitry connects to so you can permit them in a controlled environment.

If users on your network can't reach Circuitry, it is almost always a web-filter category or allowlist rule — not a problem with the site. The two fastest fixes are below: allowlist the domains in the next section, and, if your filter blocks by category, request the correct category (see If your filter blocks by category).

⚡ Quick start

For most teams, allowlisting these is enough to run Circuitry in a managed environment:

Everything else below is feature-dependent — only needed if your team uses that specific capability.

✅ What to allowlist

Always required (from each user's device)

These must be reachable from the network where people use Circuitry, over HTTPS (TCP 443):

• circuitry.dev, www.circuitry.dev — the app, marketing pages, documentation, and the /api endpoints. Served via Vercel.
• cjhoewonfnnydijsxbut.supabase.co (or allow *.supabase.co) — account sign-in, stored documents, file storage, and real-time collaboration. Real-time collaboration uses a secure WebSocket (WSS) on 443 to the same host, so proxies must permit WebSocket upgrades, not just plain HTTPS.
• fonts.googleapis.com and fonts.gstatic.com — interface fonts.

Feature-dependent

Permit these only if your team uses the matching feature:

• In-app Python (runs on the device): cdn.jsdelivr.net — downloads the Python runtime for in-app code cells and the code editor.
• Drawing & design icon library: api.iconify.design — searches and loads the icon/clip-art library used by the drawing and design tools. Without it, the icon picker and stamped icons won't load.
• Cloud AI models: depending on which providers you enable —
  • api.anthropic.com (Claude)
  • api.openai.com (OpenAI)
  • generativelanguage.googleapis.com (Gemini)
  • api.x.ai (Grok)
  • api.stability.ai (image generation)
• Integrations: when you connect a third-party service (e.g. Google Workspace, Microsoft 365, GitHub, Slack, Notion, Airtable), users' devices and our servers may contact that vendor's API (for example *.googleapis.com, graph.microsoft.com, api.github.com, slack.com). Allowlist only the vendors you actually use.
• Billing / checkout: *.stripe.com — only when subscribing or managing billing.
• Service icons: icons.duckduckgo.com — small favicons shown in the integrations gallery (cosmetic).

Handled by our servers — no client allowlist needed

The following happen server-to-server from Circuitry's infrastructure, not from your users' devices, so they do not need entries in your network allowlist: transactional email, billing webhooks, and any cloud-hosted workflow runs. They're listed here only for completeness.

🖥️ Desktop app & Circuitry Server

• The desktop app talks to circuitry.dev and the same services above. Software updates are also fetched over HTTPS from circuitry.dev.
• A paired Circuitry Server is reached on your own network (typically a LAN address or a host you operate) — there is no third-party destination to allowlist for the connection itself. If that server runs cloud AI or fetches packages, apply the relevant feature-dependent rules above to its network.

🔌 Ports & protocols

• TCP 443 (HTTPS) for all destinations above.
• TCP 443 (WSS / WebSocket) to *.supabase.co for live collaboration and to your Circuitry Server for live editing. If your proxy strips or blocks WebSocket upgrades, collaboration and some live features will appear to hang.

🔒 TLS-inspecting proxies

Circuitry works behind TLS-inspecting (MITM) proxies, but make sure your proxy's root certificate is installed on user devices and that it does not block WebSocket upgrades to *.supabase.co. We don't use certificate pinning on the web app, so standard inspection is fine.

🏷️ If your filter blocks by category

New domains are sometimes blocked because a web filter hasn't categorized them yet, flags them as a "newly registered domain," or files them under a category your policy blocks. The correct category for Circuitry is Business / Technology / Software-as-a-Service (SaaS).

If circuitry.dev is miscategorized or uncategorized in your filter (Zscaler, Cisco Umbrella, Palo Alto, Forcepoint, Netskope, Fortinet, Broadcom/Symantec, and others all accept submissions), please submit it for review — or contact us and we'll provide the details your security team needs.

🆘 Still blocked?

Contact us with the name of your web filter or proxy vendor and we'll help get Circuitry allowlisted and correctly categorized for your organization.