Remy Reference/Resources/Network requirements

Network requirements

The hosts Remy needs on a managed corporate network.

https://goremy.ai/sdk-reference/resources/network-requirements · Last updated 2026-09-29

Last updated

2026-09-29

Applies to

Remy apps and the Remy editor

Ports

TCP 443 unless noted

Email to IT

What to configure

01
Allow every host on the Builders list below.
If no one at your company builds apps in Remy, allow the shorter App users list instead.
02
Exempt those hosts from TLS inspection.
Inspection re-signs Remy's certificates with your company certificate, which breaks Remy. It can also stall the WebSocket and streaming connections the editor keeps open for the whole session.
03
Allow WebSocket upgrades.
Do this for ws.goremy.ai, and for remy-sandbox.com and all of its subdomains.

Allowlists

Most companies need the Builders list. Use the App users list only if no one at your company builds apps in Remy. Every App users host is also on the Builders list.

Builders

For companies that use and build apps in Remy.

*.madewithremy.com
*.static.mscdn.ai
f.mscdn.ai
i.mscdn.ai
v.mscdn.ai
*.upload.remyfiles.com
*.private.remyfiles.com
goremy.ai
*.goremy.ai
remy-sandbox.com
*.remy-sandbox.com
git.mscdn.ai
youai.auth.us-west-2.amazoncognito.com
cognito-idp.us-west-2.amazonaws.com

App users

For companies that use Remy apps but do not build them.

*.madewithremy.com
*.static.mscdn.ai
f.mscdn.ai
i.mscdn.ai
v.mscdn.ai
*.upload.remyfiles.com
*.private.remyfiles.com

Sign in with Remy. If an app uses Sign in with Remy, its users also need goremy.ai, *.goremy.ai, and the two Cognito hosts in the Builders list. Add them even if you chose App users.

Custom domains are not on either list. If an app is served from its own domain, add that domain separately. The app's owner can tell you which one.

What each host is for

Every host on both lists, with who needs it and why.

Host	Protocol	Needed by	Why
`<app>.madewithremy.com`	HTTPS	App users	The app, and every backend call it makes, on its own host
`*.static.mscdn.ai`	HTTPS	App users	The app's compiled code (JS, CSS, fonts)
`f.mscdn.aii.mscdn.aiv.mscdn.ai`	HTTPS	Everyone	Public files, resized images and video
`*.upload.remyfiles.com`	HTTPS	Everyone	Uploads, sent straight to storage, up to 5 GB
`*.private.remyfiles.com`	HTTPS	Everyone	Private files, through signed links
`app.goremy.ai`	HTTPS	Builders	The editor
`api.goremy.ai`	HTTPS	Builders	The editor's API
`ws.goremy.ai`	WSS	Builders	The editor's live updates
`remy-sandbox.com`	HTTPS · WSS	Builders	The dev box: agent, terminal, language server, logs
`<session>.remy-sandbox.com`	HTTPS · WSS	Builders	The live preview of the app being built, with hot reload
`git.mscdn.ai`	HTTPS	Builders	Git over HTTPS, if they clone locally
`youai.auth.us-west-2.amazoncognito.comcognito-idp.us-west-2.amazonaws.com`	HTTPS	Builders	Sign-in (Amazon Cognito)

App users also need the goremy.ai and Cognito hosts only if the app uses Sign in with Remy.

Only if the feature is used

Leave these off the allowlist unless someone at your company uses the feature. Blocking a host disables only that feature.

Feature	Hosts and ports	Copy
Voice apps	`.livekit.cloud`TCP 443`.turn.livekit.cloud`TCP 443 · UDP 3478MediaUDP 50000–60000 · TCP 7881
Billing and top-ups	`js.stripe.comapi.stripe.comm.stripe.networkhooks.stripe.com` Core hosts only. Full list: docs.stripe.com/ips
Sign in with Apple	`appleid.apple.comappleid.cdn-apple.com`
Google Drive import	`apis.google.comwww.googleapis.com`
Font picker	`fonts.googleapis.comfonts.gstatic.com`
Embedded videos	`www.youtube-nocookie.com`
Error reporting Safe to block	`us.sentry.io*.ingest.sentry.io`