> ## Documentation Index
> Fetch the complete documentation index at: https://support.legora.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Legora network and domain requirements

> Use this article when your organisation needs a list of network prerequisites and domains to allow to access Legora.

Use this list to allow Legora through your firewall or proxy. Users sign in through shared `legora.com` domains, and your workspace runs in one region.

> [!TIP]
>
> To test whether your network can reach Legora, open [connectivity.legora.com](https://connectivity.legora.com). You do not need to sign in.
>
> If a check fails, share the report with your IT team. If all checks pass but the problem continues, email the report to [support@legora.com](mailto:support@legora.com).

## Required domains

Allow outbound **HTTPS (TCP 443)** to the domains in **Global domains**, plus the domains in the table for your region.

### Global domains

Allow these domains whatever region hosts your workspace. They sit outside the regional wildcard, so a regional rule does not cover them.

| Purpose | Domains to allow | Notes |
| - | - | - |
| Dedicated login domain | Your organisation’s dedicated domain, such as `acme.app.legora.com` | The only domain specific to your organisation. Shown as **Custom URL** on the **Authentication migration** page (**Settings** > **People** > **Authentication migration**). |
| Web app | `app.legora.com` | Starting point for sign-in, and used for iManage, SharePoint, and Google Drive callbacks. |
| Sign-in pages | `login.legora.com` | Hosts the sign-in, password reset, and two-factor authentication pages. |
| Identity service | `identity.legora.com` | Used for sign-in, sessions, and account recovery. |
| Token service | `token.legora.com` | Used for token exchange and logout. |
| Single sign-on | `sso.legora.com` | Required if your organisation uses SSO. |
| Word Add-in | `word-addin.legora.com` | Used to load the Word Add-in. |
| Outlook Add-in | `outlook-addin.legora.com` | Used to load the Outlook Add-in. |
| Analytics proxy | `e.legora.com` | Used for product analytics. |
| Frontend assets | `assets.legora.com` | Hosts frontend assets, such as JavaScript, CSS, fonts, and images. |
| Help centre | `support.legora.com` | Needed to access Legora help articles in the browser. |
| Connectivity check | `connectivity.legora.com` | Hosts the connectivity check page, which tests whether your network can reach Legora. |

### Regional domains

Legora runs in four regions: **EU**, **US**, **APAC**, and **AU**. Your region is the one in your Legora address, so `app.ap.legora.com` means your workspace is hosted in APAC. If you are not sure, ask your Legora representative or email [support@legora.com](mailto:support@legora.com).

The wildcard in each region table, such as `*.eu.legora.com`, already covers the other domains listed for that region. Those domains are listed individually for firewalls and proxies that cannot match wildcards.

#### EU

Allow these domains if your workspace is hosted in the EU.

| Purpose | Domains to allow | Notes |
| - | - | - |
| Legora web app and API | `*.eu.legora.com` | Covers most Legora-owned EU services, such as `app.eu.legora.com`, `backend.eu.legora.com`, and `search.eu.legora.com`. |
| Document uploads | `uploads.eu.legora.com` | Used by the browser to upload documents directly to Legora-managed storage. |
| Realtime collaboration | `wss://multiplayer.eu.legora.com` | Used for realtime collaboration. Runs over WSS (443). |
| Feature flags | `ld.eu.legora.com` | Used to fetch feature flag configuration. |
| Telemetry | `otel2.eu.legora.com` | Used to send product telemetry. |
| Word Add-in API | `word-addin-backend.eu.legora.com` | Used for Word Add-in editor and document API calls. |
| Live collaboration | `eu-realtime.ably.io`, `eu-rest.ably.io`, `eu-a-fallback.ably-realtime.com`, `eu-b-fallback.ably-realtime.com`, `eu-c-fallback.ably-realtime.com`, `eu-d-fallback.ably-realtime.com`, `eu-e-fallback.ably-realtime.com` | Used for live collaboration in Tabular Review. Runs over HTTPS and WSS (443). `*.ably.io` and `*.ably-realtime.com` cover these domains. Allow all five fallback domains for your region. Ably switches to one of them when it cannot reach the main domain. |

#### US

Allow these domains if your workspace is hosted in the US.

| Purpose | Domains to allow | Notes |
| - | - | - |
| Legora web app and API | `*.us.legora.com` | Covers most Legora-owned US services, such as `app.us.legora.com`, `backend.us.legora.com`, and `search.us.legora.com`. |
| Document uploads | `uploads.us.legora.com` | Used by the browser to upload documents directly to Legora-managed storage. |
| Realtime collaboration | `wss://multiplayer.us.legora.com` | Used for realtime collaboration. Runs over WSS (443). |
| Feature flags | `ld.us.legora.com` | Used to fetch feature flag configuration. |
| Telemetry | `otel2.us.legora.com` | Used to send product telemetry. |
| Word Add-in API | `word-addin-backend.us.legora.com` | Used for Word Add-in editor and document API calls. |
| Live collaboration | `us-realtime.ably.io`, `us-rest.ably.io`, `us-a-fallback.ably-realtime.com`, `us-b-fallback.ably-realtime.com`, `us-c-fallback.ably-realtime.com`, `us-d-fallback.ably-realtime.com`, `us-e-fallback.ably-realtime.com` | Used for live collaboration in Tabular Review. Runs over HTTPS and WSS (443). `*.ably.io` and `*.ably-realtime.com` cover these domains. Allow all five fallback domains for your region. Ably switches to one of them when it cannot reach the main domain. |

#### APAC

Allow these domains if your workspace is hosted in APAC.

| Purpose | Domains to allow | Notes |
| - | - | - |
| Legora web app and API | `*.ap.legora.com` | Covers most Legora-owned APAC services, such as `app.ap.legora.com`, `backend.ap.legora.com`, and `search.ap.legora.com`. |
| Document uploads | `uploads.ap.legora.com` | Used by the browser to upload documents directly to Legora-managed storage. |
| Realtime collaboration | `wss://multiplayer.ap.legora.com` | Used for realtime collaboration. Runs over WSS (443). |
| Feature flags | `ld.ap.legora.com` | Used to fetch feature flag configuration. |
| Telemetry | `otel2.ap.legora.com` | Used to send product telemetry. |
| Word Add-in API | `word-addin-backend.ap.legora.com` | Used for Word Add-in editor and document API calls. |
| Live collaboration | `eu-realtime.ably.io`, `eu-rest.ably.io`, `eu-a-fallback.ably-realtime.com`, `eu-b-fallback.ably-realtime.com`, `eu-c-fallback.ably-realtime.com`, `eu-d-fallback.ably-realtime.com`, `eu-e-fallback.ably-realtime.com` | Used for live collaboration in Tabular Review. Runs over HTTPS and WSS (443). `*.ably.io` and `*.ably-realtime.com` cover these domains. Allow all five fallback domains for your region. Ably switches to one of them when it cannot reach the main domain. |

#### AU

Allow these domains if your workspace is hosted in Australia.

| Purpose | Domains to allow | Notes |
| - | - | - |
| Legora web app and API | `*.au.legora.com` | Covers most Legora-owned AU services, such as `app.au.legora.com`, `backend.au.legora.com`, and `search.au.legora.com`. |
| Document uploads | `uploads.au.legora.com` | Used by the browser to upload documents directly to Legora-managed storage. |
| Realtime collaboration | `wss://multiplayer.au.legora.com` | Used for realtime collaboration. Runs over WSS (443). |
| Feature flags | `ld.au.legora.com` | Used to fetch feature flag configuration. |
| Telemetry | `otel2.au.legora.com` | Used to send product telemetry. |
| Word Add-in API | `word-addin-backend.au.legora.com` | Used for Word Add-in editor and document API calls. |
| Live collaboration | `eu-realtime.ably.io`, `eu-rest.ably.io`, `eu-a-fallback.ably-realtime.com`, `eu-b-fallback.ably-realtime.com`, `eu-c-fallback.ably-realtime.com`, `eu-d-fallback.ably-realtime.com`, `eu-e-fallback.ably-realtime.com` | Used for live collaboration in Tabular Review. Runs over HTTPS and WSS (443). `*.ably.io` and `*.ably-realtime.com` cover these domains. Allow all five fallback domains for your region. Ably switches to one of them when it cannot reach the main domain. |

***

## Callback URLs

Add these URLs to your identity provider and integration settings so sign-in and integrations can return users to Legora.

### SSO callback URLs

If your organisation uses SSO, add the callback URL that matches your sign-in protocol as an allowed callback or redirect URI in your identity provider configuration:

* `https://sso.legora.com/api/oauth/saml` for SAML connections
* `https://sso.legora.com/api/oauth/oidc` for OpenID Connect (OIDC) connections, including Microsoft Entra ID

### Integration callback URLs

If your organisation uses these integrations, add the relevant Legora callback URL as an allowed redirect URI in the integration’s admin settings. Keep any existing URLs in place.

| Integration | Callback URL to allow | Notes |
| - | - | - |
| iManage on-premises | `https://app.legora.com/imanage` | Required for organisations using the iManage on-premises integration. |
| SharePoint | `https://app.legora.com/sharepoint` | Required for organisations using the SharePoint integration. |
| Google Drive | `https://app.legora.com/google-drive` | Required for organisations using the Google Drive integration. |

***

## Document uploads

Legora uses a dedicated upload domain to make document uploads faster and more reliable, especially for larger files and large batches.

When someone uploads a document, the browser sends the file directly to a secure, Legora-managed upload location for the workspace region. The product experience does not change.

The upload domain:

* Is only used for uploads
* Is not a website where users can browse files
* Is not a general-purpose API endpoint
* Uses HTTPS over port 443

If the upload domain is blocked, users may still be able to access Legora, but document uploads may fail.

***

## Optional third-party domains

Depending on your organisation’s configuration, Legora may also use these third-party domains.

| Service | Domains to allow | When needed |
| - | - | - |
| Error monitoring | `.sentry.io` | If your security policy requires explicit allowlisting for third-party services. |
| Google authentication | `accounts.google.com` | If users authenticate with Google. |
| Google Drive integration | `apis.google.com` | If Google Drive integration is enabled. |
| Fonts | `fonts.googleapis.com`, `fonts.gstatic.com` | If your environment restricts external font loading. |
| Microsoft Office add-ins | `appsforoffice.microsoft.com` | Required for the Legora Word and Outlook add-ins to start in Word or Outlook. |

***

## **Optional integration domains**

If your organisation uses integrations with Legora, allow the domains required for those services.

| Integration | Domains to allow | Notes |
| - | - | - |
| iManage | `cloudimanage.com`, `*.cloudimanage.com` | Also allow any customer-specific iManage on-premises domains, if applicable. |
| Google Drive | Google Drive and Google OAuth domains | The exact domains depend on your Google configuration. |
| SharePoint / Microsoft 365 | Microsoft Graph, SharePoint, and Microsoft login domains | The exact domains depend on the customer tenant. |

***

## Network requirements

* Allow outbound **HTTPS (TCP 443)**.
* If your network setup restricts inbound callback, proxy, or inspection traffic, allow the required domains inbound where applicable.
* Allow **WebSocket over TLS (WSS 443)** for realtime features.
* Prefer **domain allowlisting** over **IP allowlisting**, because cloud service IPs can change.
* Make sure large file uploads are not blocked or interrupted by your proxy, firewall, or inspection rules.

### TLS inspection

If you use **TLS inspection**, make sure it does not break:

* Authentication (OIDC / SSO)
* Microsoft Office add-ins
* WebSocket connections
* Large document uploads

***

## Legacy regional authentication

Some organisations still sign in through a regional authentication domain and use the regional Word and Outlook add-ins. If your organisation does, also allow these domains for your region.

| Region | Domains to allow |
| - | - |
| EU | `auth.eu.legora.com`, `word-addin.eu.legora.com`, `outlook-addin.eu.legora.com` |
| US | `auth.us.legora.com`, `word-addin.us.legora.com`, `outlook-addin.us.legora.com` |
| APAC | `auth.ap.legora.com`, `word-addin.ap.legora.com`, `outlook-addin.ap.legora.com` |
| AU | `auth.au.legora.com`, `word-addin.au.legora.com`, `outlook-addin.au.legora.com` |

Also allow `auth.legora.com`, the legacy authentication domain.

If your organisation is moving off regional authentication, keep these domains allowed alongside the global domains until the move is complete. For the steps, see [IT Admin guide: Legora’s global authentication](https://support.legora.com/en-GB/it-admin-guide-legora-s-new-authentication-protocol.md).

***

## Troubleshooting

If something does not work, open [connectivity.legora.com](https://connectivity.legora.com) first. The page shows which connections your network blocks. Then use the matching section below.

### If the Word or Outlook add-in shows “We couldn’t start…”

Make sure your firewall or proxy allows outbound HTTPS (TCP 443) to `appsforoffice.microsoft.com` and the Word and Outlook Add-in domains in [Global domains](#global-domains). If you use TLS inspection, exclude Microsoft Office add-in traffic so certificates are not rewritten.

### If document uploads fail

Make sure your firewall or proxy allows outbound HTTPS (TCP 443) to the upload domain for your region, listed under [Required domains](#required-domains).

### If Legora loads but realtime features do not work

Make sure WebSockets are allowed over WSS (443) and that your proxy or firewall is not downgrading or blocking WebSocket connections.

### If login loops or sessions do not persist

Avoid blocking, rewriting, or stripping Legora authentication and session cookies.