Legora network and domain requirements - Legora

If your organization restricts outbound network traffic, you may also need to allow Legora’s dedicated upload domain.

Required domains

Allow outbound HTTPS (TCP 443) to the domains for your Legora region.

EU

Purpose	Domains to allow	Notes
Legora web app and API	`.eu.legora.com`	Covers most Legora-owned EU services, such as `app.eu.legora.com`, `backend.eu.legora.com`, and `search.eu.legora.com`.
Document uploads	`uploads.eu.legora.com`	Used by the browser to upload documents directly to Legora-managed storage.
Realtime collaboration	`wss://multiplayer.eu.legora.com`	Used for realtime collaboration. Runs over WSS (443).
Authentication	`auth.eu.legora.com`	Used for login, token exchange, and logout. For organizations migrating to Legora’s new authentication protocol, also allow `auth.legora.com`.
Feature flags	`ld.eu.legora.com`	Used to fetch feature flag configuration.
Telemetry	`otel2.eu.legora.com`	Used to send product telemetry.
Word Add-in backend	`word-addin-backend.eu.legora.com`	Used by the Word Add-in for editor and document API calls.
Analytics proxy	`e.legora.com`	Must be allowed separately because it is outside the `.eu.legora.com` wildcard.
Frontend assets	`assets.legora.com`	Hosts frontend assets, such as JavaScript, CSS, fonts, and images.
Help center	`support.legora.com`	Needed to access Legora help articles in the browser.

Other regions

If your workspace is hosted outside the EU, allow the equivalent region domains.

Purpose	Domains to allow	Notes
Legora web app and API	`*.<region>.legora.com`	Replace `<region>` with the region your workspace uses, such as `us`, `ap`, or `au`.
Document uploads	`uploads.<region>.legora.com`	For example, `uploads.us.legora.com`, `uploads.ap.legora.com`, or `uploads.au.legora.com`.
Realtime collaboration	`wss://multiplayer.<region>.legora.com`	Runs over WSS (443).
Word Add-in	`word-addin.<region>.legora.com`, `word-addin-backend.<region>.legora.com`	Used by the Word Add-in.
Authentication	`auth.<region>.legora.com`, `auth.legora.com`	Used for login, token exchange, logout, and Legora’s new authentication protocol.
Analytics proxy	`e.legora.com`	Must be allowed separately from region domains.
Frontend assets	`assets.legora.com`	Hosts frontend assets, such as JavaScript, CSS, fonts, and images.
Help center	`support.legora.com`	Needed to access Legora help articles in the browser.

Authentication migration requirements

If your organization is migrating to Legora’s new authentication protocol, also allow HTTPS (TCP 443) to:

Your organization’s dedicated Legora login domain, shown in Settings > Authentication migration
auth.legora.com
sso.legora.com, if you use SSO
app.legora.com, if you use integrations that require migration callback URLs, such as iManage, SharePoint, or Google Drive

Apply these rules to outbound traffic by default, and to inbound traffic where applicable to your network, proxy, or firewall setup.

SSO callback URLs

If your organization uses SSO, add these callback URLs as allowed callback or redirect URIs in your identity provider configuration:

https://sso.legora.com/api/oauth/saml
https://sso.legora.com/api/oauth/oidc

Integration callback URLs

If your organization uses these integrations, add the relevant Legora callback URL as an allowed redirect URI in the integration’s admin settings. Keep any existing URLs in place.

Integration	Callback URL to allow	Notes
iManage on-premises	`https://app.legora.com/imanage`	Required for organizations using the iManage on-premises integration.
SharePoint	`https://app.legora.com/sharepoint`	Required for organizations using the SharePoint integration.
Google Drive	`https://app.legora.com/google-drive`	Required for organizations using the Google Drive integration.

Document uploads

Legora uses a dedicated upload domain to make document uploads faster and more reliable, especially for larger files and large batches. When someone uploads a document, the browser sends the file directly to a secure, Legora-managed upload location for the workspace region. The product experience does not change. The upload domain:

Is only used for uploads
Is not a website where users can browse files
Is not a general-purpose API endpoint
Uses HTTPS over port 443

If the upload domain is blocked, users may still be able to access Legora, but document uploads may fail.

Optional third-party domains

Depending on your organization’s configuration, Legora may also use these third-party domains.

Service	Domains to allow	When needed
Error monitoring	`.sentry.io`	If your security policy requires explicit allowlisting for third-party services.
Google authentication	`accounts.google.com`	If users authenticate with Google.
Google Drive integration	`apis.google.com`	If Google Drive integration is enabled.
Fonts	`fonts.googleapis.com`, `fonts.gstatic.com`	If your environment restricts external font loading.

Optional integration domains

If your organization uses integrations with Legora, allow the domains required for those services.

Integration	Domains to allow	Notes
iManage	`cloudimanage.com`, `*.cloudimanage.com`	Also allow any customer-specific iManage on-premises domains, if applicable.
Legora integration callbacks	`app.legora.com`	Required during authentication migration for callback URLs used by iManage on-premises, SharePoint, and Google Drive.
Google Drive	Google Drive and Google OAuth domains	The exact domains depend on your Google configuration.
SharePoint / Microsoft 365	Microsoft Graph, SharePoint, and Microsoft login domains	The exact domains depend on the customer tenant.

Network requirements

Allow outbound HTTPS (TCP 443).
If your network setup restricts inbound callback, proxy, or inspection traffic, allow the required domains inbound where applicable.
Allow WebSocket over TLS (WSS 443) for realtime features.
Prefer domain allowlisting over IP allowlisting, because cloud service IPs can change.
Make sure large file uploads are not blocked or interrupted by your proxy, firewall, or inspection rules.

TLS inspection

If you use TLS inspection, make sure it does not break:

Authentication (OIDC / SSO)
Microsoft Office add-ins
WebSocket connections
Large document uploads

Troubleshooting

If document uploads fail

Make sure your firewall or proxy allows outbound HTTPS (TCP 443) to the relevant upload domain, such as uploads.eu.legora.com.

If Legora loads but realtime features do not work

Make sure WebSockets are allowed over WSS (443) and that your proxy or firewall is not downgrading or blocking WebSocket connections. Avoid blocking, rewriting, or stripping Legora authentication and session cookies.

​Required domains

​EU

​Other regions

​Authentication migration requirements

​SSO callback URLs

​Integration callback URLs

​Document uploads

​Optional third-party domains

​Optional integration domains

​Network requirements

​TLS inspection

​Troubleshooting

​If document uploads fail

​If Legora loads but realtime features do not work

​If login loops or sessions do not persist