If your firm routes traffic through a corporate proxy, PAC file, or firewall, a few domains need to be allowed (or bypassed) for Pirros to work. This article is the definitive list, written for the IT team that manages those rules.
Signs Something Is Being Blocked
When a required domain is blocked, the most common symptoms are:
A new user clicks their invite link, enters their email, and gets sent back to the email screen in a loop — they never reach the step to create a password.
Sign-in works on a home network or with the PAC file turned off, but fails on the office network.
The Pirros pane inside Revit (Pirros in Revit) stays blank or fails to load.
Turning the proxy or PAC file off will usually confirm the cause, but it isn't a long-term fix. Adding the domains below is.
Domains to Allow
REQUIRED
Pirros Domains
All of these are required. Note that auth.pirros.com, auth.pirros.io, and pirros-prod.us.auth0.com are three different services — all need to be allowed.
Domain | What it's used for |
app.pirros.com | The Pirros web app and the Pirros pane in Revit |
api.pirros.com | The Pirros API that the web app and plugin talk to — used by both Revit plugins and their automatic updaters |
auth.pirros.io | The Pirros login and sign-in page. Also used by the classic plugin's sign-in window (Settings ▸ Login) |
auth.pirros.com | Pirros's own sign-in service, used behind the scenes after you log in. Also used for Pirros in Revit and Mira |
app.pirros.io | Secondary Pirros web app domain |
Email Links
Domain | What it's used for |
e.customeriomail.com | Invite email button (link tracking) |
url2067.pirros.com | Forgot Password and account emails (link tracking, http port 80) |
Sign-In Pages and Images
cdn.auth0.com | Sign-in page scripts and styling |
res.cloudinary.com | Previews and sign-in page images |
Library, Search, and Live Updates
Domain | What it's used for |
oek4ddlss5-dsn.algolia.net | Library Browse and Search |
oek4ddlss5-1.algolianet.com | Search fallback |
oek4ddlss5-2.algolianet.com | Search fallback |
oek4ddlss5-3.algolianet.com | Search fallback |
ws-us3.pusher.com | Live updates and Live Link (WebSocket) — Live Link in both Revit plugins |
app.launchdarkly.com | Feature settings (features can go missing without this) |
events.launchdarkly.com | Feature settings (features can go missing without this) |
Installs, Updates, and Files
Domain | What it's used for |
pirros-plugins.s3.us-west-1.amazonaws.com | Plugin Installers and Updates — the plugin's automatic updater downloads new versions from here |
pirros-prod.s3.us-west-1.amazonaws.com | Family and Detail files |
pirros-chatbot-plugins.s3.us-west-1.amazonaws.com | Mira Installer and updates (Mira only) |
Bot-detection check
Domain | What it's used for |
newassets.hcaptcha.com | The captcha shown on the login and sign-up page when extra verification is needed |
This one is easy to miss. The captcha only appears some of the time, so it rarely shows up in a normal test — but it's much more likely to appear on a proxied network, because every user shares the same outbound IP address. If the captcha is required but blocked, the sign-in form submits and lands back on the email screen, which produces the invite-link loop described above.
Confirming the Fix
To check whether the captcha is the culprit, have an affected User open the invite link in Chrome or Edge and:
Press F12 to open Developer Tools and select the Network tab.
Type captcha in the filter box.
Go through the sign-in steps. If requests to newassets.hcaptcha.com show as failed or blocked, add it to your allow list.
Once the domains are added, have the User close the browser tab and open the invite link again.
ONLY IF USED
Your identity provider
If your firm signs in to Pirros with single sign-on, your identity provider's domains also need to be reachable. These vary by firm. Common examples:
Microsoft Entra ID (Azure AD):
login.microsoftonline.com
login.microsoft.com
aadcdn.msauth.net
aadcdn.msftauth.net
device.login.microsoftonline.com
Okta:
<yourfirm>.okta.com
login.okta.com
Duo:
duosecurity.com
Captcha:
hcaptcha.com (shown only when bot detection triggers)
Autodesk (ACC):
developer.api.autodesk.com
idp.auth.autodesk.com
signin.autodesk.com
Billing pages:
js.stripe.com
m.stripe.network
checkout.stripe.com
billing.stripe.com
RECOMMENDED
Domain | What it's used for |
log-api.newrelic.com | Plugin logs (telemetry from both Revit plugins and their automatic updaters), so Support can troubleshoot |
otlp.nr-data.net (port 4317) | Classic plugin logs (telemetry), so Support can troubleshoot |
widget.intercom.io | Support chat and help |
js.intercomcdn.com | Support chat and help |
api-iam.intercom.io | Support chat and help |
nexus-websocket-a.intercom.io | Support chat and help |
help.pirros.com | Support chat and help |
use.typekit.net | Fonts |
p.typekit.net | Fonts |
SAFE TO BLOCK (Analytics and in-App messages)
analytics.pirros.com
tracking.pirros.com
o4506780309848064.ingest.sentry.io
api-sr.amplitude.com
sr-client-cfg.amplitude.com
cdn.vitally.io
pirros.api.vitally.io
pirros.app.vitally.io
insights.algolia.io
cdn.jsdelivr.net
assets.customer.io
track.customer.io
code.gist.build
consumer.cloud.gist.build
Revit Plugin: Domains by Version
Pirros has two Revit plugins — Pirros in Revit (a docked panel) and the classic plugin — and they don't use exactly the same domains. Each plugin, and the automatic updater that keeps it current, contacts these domains from the lists above:
Pirros in Revit: app.pirros.com, api.pirros.com and auth.pirros.com. The panel is the Pirros web app running inside Revit, so it also needs the web app's sign-in, search and live-update domains. Live Link uses ws-us3.pusher.com. Plugin logs go to log-api.newrelic.com.
Classic plugin: api.pirros.com and auth.pirros.io (its sign-in window). Live Link uses ws-us3.pusher.com. The plugin's Pirros button opens app.pirros.com in your web browser. Plugin logs go to log-api.newrelic.com and otlp.nr-data.net (port 4317).
Automatic updater (runs in the background as the Windows SYSTEM account, whichever plugin you have): api.pirros.com, then the plugin installer storage listed under Installs, Updates, and Files. Its logs go to log-api.newrelic.com.
Certificate revocation checks: the automatic updater that comes with a 4.x installer checks the installer's digital signature before installing an update, including whether the signing certificate has been revoked. If the computer can't reach the certificate authority's revocation (CRL/OCSP) servers, the update isn't installed — so allow certificate revocation checks through your proxy or firewall. The updater that comes with a 3.x installer doesn't make this check.
Installing the Revit Plugin
The domains above cover signing in and using Pirros. If your firewall is blocking the plugin installer itself, see Revit Plugin: Download & Installation. Automatic plugin updates need the domains listed for the automatic updater above.
Still Having Trouble?
Reach out to our Support team through the chat in the bottom-right corner. Let us know which domains you've allowed and what the User sees, and we'll help you track down anything that's still blocked.
