> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flowsign.app/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Flowsign is one word with a lowercase s.
> The REST API base URL is https://my.flowsign.app and every endpoint lives under /api/v1.
> When answering API questions, cite the HTTP method and endpoint path.
> API access needs the Enterprise plan and an API key with the API access permission.

# Network requirements

> The domains, ports and TLS rules your IT team needs to allow so Flowsign works behind a firewall, proxy or web filter.

This page is for IT and network teams whose organisation restricts web traffic with a firewall, proxy or web filter. It lists every domain the Flowsign web app needs, and the rules that apply to them.

## In a nutshell

* Allow the domains in the tables below, or simply `*.flowsign.app` plus the third-party services.
* All traffic is HTTPS on port **443**. Nothing uses plain HTTP, websockets or other ports.
* If your proxy inspects TLS, its certificate must be trusted by every browser that uses Flowsign. Otherwise pages fail to load with no way to click through.
* Some web filters block the `.app` top-level domain by default. Make sure `.app` is allowed.

## Flowsign domains

| Domain | Used for | Who needs it |
| - | - | - |
| `my.flowsign.app` | The Flowsign app, signing pages, the API and links in emails | Everyone, including recipients |
| `auth.flowsign.app` | Sign-in, and the documents and images shown in the app and on signing pages | Everyone, including recipients |
| `flowsign.app` | Website and legal pages | Everyone |
| `docs.flowsign.app` | This help centre | Recommended |

## Third-party services

| Domain | Service | Who needs it |
| - | - | - |
| `challenges.cloudflare.com` | Bot protection (Cloudflare Turnstile) on sign-in, sign-up and password reset | Members |
| `accounts.google.com` | Sign in with Google | Members who use Google sign-in |
| `login.microsoftonline.com` | Sign in with Microsoft | Members who use Microsoft sign-in |
| Your identity provider | Single sign-on, such as Okta or Microsoft Entra ID | Members, if your organisation uses [SSO](/guides/settings/security.md) |
| `js.stripe.com`, `api.stripe.com`, `hooks.stripe.com`, `billing.stripe.com`, `*.stripe.com` | Payments (Stripe) | Owners and billing admins |
| `*.ingest.de.sentry.io` | Error reporting (Sentry) | Recommended |
| `eu.i.posthog.com`, `eu-assets.i.posthog.com` | Product analytics (PostHog) | Recommended |

Flowsign works without the services marked **Recommended**, but blocking error reporting means we can't see problems your team runs into. Signing pages don't load analytics.

## Ports and protocols

Every connection from the browser is HTTPS (TLS) on TCP port **443**. Flowsign doesn't need port 80, websockets, or any other port or protocol.

## HSTS and TLS inspection

Every `.app` domain is on the HSTS preload list built into Chrome, Edge, Safari and Firefox. Browsers only ever connect to `flowsign.app` and its subdomains over HTTPS, and they refuse the connection if the certificate isn't valid and trusted. There's no warning page to click past.

If your proxy or firewall inspects TLS traffic, either:

* exclude the Flowsign domains from inspection, or
* make sure the proxy's root certificate is installed and trusted on every device and browser that opens Flowsign.

## The .app top-level domain

Some web filters and DNS security services block newer top-level domains like `.app` by default, or put them in an "uncategorised" group. If Flowsign doesn't load at all, check that `.app`, or at least `*.flowsign.app`, is allowed.

## Email

Flowsign sends email from `flowsign.app` addresses, such as `signing@flowsign.app` and `team@flowsign.app`. Mail is sent through Resend, with DKIM signed for `flowsign.app` and a return path on `send.flowsign.app`.

If signing requests or notifications land in spam or quarantine, allow the `flowsign.app` sender domain in your email filter. Links in Flowsign emails always point to `my.flowsign.app`.

## Still blocked?

[Contact support](/support/contact.md) with the domain your filter blocked and a screenshot of the message, and we'll help you work it out.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.