> ## Documentation Index > Fetch the complete documentation index at: https://support.legora.com/llms.txt > Use this file to discover all available pages before exploring further. # Legora network and domain requirements > Use this article when your organization needs a list of network prerequisites and domains to allow to access Legora. If your organization restricts outbound network traffic, you may also need to allow Legora’s dedicated upload domain. ## Required domains Allow outbound **HTTPS (TCP 443)** to the domains for your Legora region. ### **EU** | Purpose | Domains to allow | Notes | | ---------------------- | ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | | Legora web app and API | `.eu.legora.com` | Covers most Legora-owned EU services, such as `app.eu.legora.com`, `backend.eu.legora.com`, and `search.eu.legora.com`. | | Document uploads | `uploads.eu.legora.com` | Used by the browser to upload documents directly to Legora-managed storage. | | Realtime collaboration | `wss://multiplayer.eu.legora.com` | Used for realtime collaboration. Runs over WSS (443). | | Authentication | `auth.eu.legora.com` | Used for login, token exchange, and logout. For organizations migrating to Legora’s new authentication protocol, also allow `auth.legora.com`. | | Feature flags | `ld.eu.legora.com` | Used to fetch feature flag configuration. | | Telemetry | `otel2.eu.legora.com` | Used to send product telemetry. | | Word Add-in backend | `word-addin-backend.eu.legora.com` | Used by the Word Add-in for editor and document API calls. | | Analytics proxy | `e.legora.com` | Must be allowed separately because it is outside the `.eu.legora.com` wildcard. | | Frontend assets | `assets.legora.com` | Hosts frontend assets, such as JavaScript, CSS, fonts, and images. | | Help center | `support.legora.com` | Needed to access Legora help articles in the browser. | ### Other regions If your workspace is hosted outside the EU, allow the equivalent region domains. | Purpose | Domains to allow | Notes | | ---------------------- | -------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ | | Legora web app and API | `*..legora.com` | Replace `` with the region your workspace uses, such as `us`, `ap`, or `au`. | | Document uploads | `uploads..legora.com` | For example, `uploads.us.legora.com`, `uploads.ap.legora.com`, or `uploads.au.legora.com`. | | Realtime collaboration | `wss://multiplayer..legora.com` | Runs over WSS (443). | | Word Add-in | `word-addin..legora.com`, `word-addin-backend..legora.com` | Used by the Word Add-in. | | Authentication | `auth..legora.com`, `auth.legora.com` | Used for login, token exchange, logout, and Legora’s new authentication protocol. | | Analytics proxy | `e.legora.com` | Must be allowed separately from region domains. | | Frontend assets | `assets.legora.com` | Hosts frontend assets, such as JavaScript, CSS, fonts, and images. | | Help center | `support.legora.com` | Needed to access Legora help articles in the browser. | *** ## **Authentication migration requirements** If your organization is migrating to Legora’s new authentication protocol, also allow **HTTPS (TCP 443)** to: * Your organization’s dedicated Legora login domain, shown in **Settings > Authentication migration** * `auth.legora.com` * `sso.legora.com`, if you use SSO * `app.legora.com`, if you use integrations that require migration callback URLs, such as iManage, SharePoint, or Google Drive Apply these rules to outbound traffic by default, and to inbound traffic where applicable to your network, proxy, or firewall setup. ### **SSO callback URLs** If your organization uses SSO, add these callback URLs as allowed callback or redirect URIs in your identity provider configuration: * `https://sso.legora.com/api/oauth/saml` * `https://sso.legora.com/api/oauth/oidc` ### **Integration callback URLs** If your organization uses these integrations, add the relevant Legora callback URL as an allowed redirect URI in the integration’s admin settings. Keep any existing URLs in place. | Integration | Callback URL to allow | Notes | | ------------------- | ------------------------------------- | --------------------------------------------------------------------- | | iManage on-premises | `https://app.legora.com/imanage` | Required for organizations using the iManage on-premises integration. | | SharePoint | `https://app.legora.com/sharepoint` | Required for organizations using the SharePoint integration. | | Google Drive | `https://app.legora.com/google-drive` | Required for organizations using the Google Drive integration. | *** ## Document uploads Legora uses a dedicated upload domain to make document uploads faster and more reliable, especially for larger files and large batches. When someone uploads a document, the browser sends the file directly to a secure, Legora-managed upload location for the workspace region. The product experience does not change. The upload domain: * Is only used for uploads * Is not a website where users can browse files * Is not a general-purpose API endpoint * Uses HTTPS over port 443 If the upload domain is blocked, users may still be able to access Legora, but document uploads may fail. *** ## Optional third-party domains Depending on your organization’s configuration, Legora may also use these third-party domains. | Service | Domains to allow | When needed | | ------------------------ | ------------------------------------------- | -------------------------------------------------------------------------------- | | Error monitoring | `.sentry.io` | If your security policy requires explicit allowlisting for third-party services. | | Google authentication | `accounts.google.com` | If users authenticate with Google. | | Google Drive integration | `apis.google.com` | If Google Drive integration is enabled. | | Fonts | `fonts.googleapis.com`, `fonts.gstatic.com` | If your environment restricts external font loading. | *** ## **Optional integration domains** If your organization uses integrations with Legora, allow the domains required for those services. | Integration | Domains to allow | Notes | | ---------------------------- | -------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- | | iManage | `cloudimanage.com`, `*.cloudimanage.com` | Also allow any customer-specific iManage on-premises domains, if applicable. | | Legora integration callbacks | `app.legora.com` | Required during authentication migration for callback URLs used by iManage on-premises, SharePoint, and Google Drive. | | Google Drive | Google Drive and Google OAuth domains | The exact domains depend on your Google configuration. | | SharePoint / Microsoft 365 | Microsoft Graph, SharePoint, and Microsoft login domains | The exact domains depend on the customer tenant. | *** ## Network requirements * Allow outbound **HTTPS (TCP 443)**. * If your network setup restricts inbound callback, proxy, or inspection traffic, allow the required domains inbound where applicable. * Allow **WebSocket over TLS (WSS 443)** for realtime features. * Prefer **domain allowlisting** over **IP allowlisting**, because cloud service IPs can change. * Make sure large file uploads are not blocked or interrupted by your proxy, firewall, or inspection rules. ### TLS inspection If you use **TLS inspection**, make sure it does not break: * Authentication (OIDC / SSO) * Microsoft Office add-ins * WebSocket connections * Large document uploads *** ## Troubleshooting ### If document uploads fail Make sure your firewall or proxy allows outbound HTTPS (TCP 443) to the relevant upload domain, such as `uploads.eu.legora.com`. ### If Legora loads but realtime features do not work Make sure WebSockets are allowed over WSS (443) and that your proxy or firewall is not downgrading or blocking WebSocket connections. ### If login loops or sessions do not persist Avoid blocking, rewriting, or stripping Legora authentication and session cookies.