Skip to main content

Network Requirements: Domains to Allow Through Your Proxy, PAC File, or Firewall

The full list of domains your IT team needs to allow for Pirros sign-in, the web app, and the Revit plugin to work behind a corporate proxy, PAC file, or firewall.

If your firm routes traffic through a corporate proxy, PAC file, or firewall, a few domains need to be allowed (or bypassed) for Pirros to work. This article is the definitive list, written for the IT team that manages those rules.

Signs Something Is Being Blocked

When a required domain is blocked, the most common symptoms are:

  • A new user clicks their invite link, enters their email, and gets sent back to the email screen in a loop — they never reach the step to create a password.

  • Sign-in works on a home network or with the PAC file turned off, but fails on the office network.

  • The Pirros pane inside Revit (Pirros in Revit) stays blank or fails to load.

Turning the proxy or PAC file off will usually confirm the cause, but it isn't a long-term fix. Adding the domains below is.

Domains to Allow

REQUIRED

Pirros Domains

All of these are required. Note that auth.pirros.com, auth.pirros.io, and pirros-prod.us.auth0.com are three different services — all need to be allowed.

Domain

What it's used for

app.pirros.com

The Pirros web app and the Pirros pane in Revit

api.pirros.com

The Pirros API that the web app and plugin talk to — used by both Revit plugins and their automatic updaters

auth.pirros.io

The Pirros login and sign-in page. Also used by the classic plugin's sign-in window (Settings ▸ Login)

auth.pirros.com

Pirros's own sign-in service, used behind the scenes after you log in. Also used for Pirros in Revit and Mira

app.pirros.io

Secondary Pirros web app domain

Email Links

Domain

What it's used for

e.customeriomail.com

Invite email button (link tracking)

url2067.pirros.com

Forgot Password and account emails (link tracking, http port 80)

Sign-In Pages and Images

cdn.auth0.com

Sign-in page scripts and styling

res.cloudinary.com

Previews and sign-in page images

Library, Search, and Live Updates

Domain

What it's used for

oek4ddlss5-dsn.algolia.net

Library Browse and Search

oek4ddlss5-1.algolianet.com

Search fallback

oek4ddlss5-2.algolianet.com

Search fallback

oek4ddlss5-3.algolianet.com

Search fallback

ws-us3.pusher.com

Live updates and Live Link (WebSocket) — Live Link in both Revit plugins

app.launchdarkly.com

Feature settings (features can go missing without this)

events.launchdarkly.com

Feature settings (features can go missing without this)

Installs, Updates, and Files

Domain

What it's used for

pirros-plugins.s3.us-west-1.amazonaws.com

Plugin Installers and Updates — the plugin's automatic updater downloads new versions from here

pirros-prod.s3.us-west-1.amazonaws.com

Family and Detail files

pirros-chatbot-plugins.s3.us-west-1.amazonaws.com

Mira Installer and updates (Mira only)

Bot-detection check

Domain

What it's used for

newassets.hcaptcha.com

The captcha shown on the login and sign-up page when extra verification is needed

This one is easy to miss. The captcha only appears some of the time, so it rarely shows up in a normal test — but it's much more likely to appear on a proxied network, because every user shares the same outbound IP address. If the captcha is required but blocked, the sign-in form submits and lands back on the email screen, which produces the invite-link loop described above.

Confirming the Fix

To check whether the captcha is the culprit, have an affected User open the invite link in Chrome or Edge and:

  1. Press F12 to open Developer Tools and select the Network tab.

  2. Type captcha in the filter box.

  3. Go through the sign-in steps. If requests to newassets.hcaptcha.com show as failed or blocked, add it to your allow list.

Once the domains are added, have the User close the browser tab and open the invite link again.

ONLY IF USED

Your identity provider

If your firm signs in to Pirros with single sign-on, your identity provider's domains also need to be reachable. These vary by firm. Common examples:

  • Microsoft Entra ID (Azure AD):

    • login.microsoftonline.com

    • login.microsoft.com

    • aadcdn.msauth.net

    • aadcdn.msftauth.net

    • device.login.microsoftonline.com

  • Okta:

    • <yourfirm>.okta.com

    • login.okta.com

  • Duo:

    • duosecurity.com

  • Captcha:

    • hcaptcha.com (shown only when bot detection triggers)

  • Autodesk (ACC):

    • developer.api.autodesk.com

    • idp.auth.autodesk.com

    • signin.autodesk.com

  • Billing pages:

    • js.stripe.com

    • m.stripe.network

    • checkout.stripe.com

    • billing.stripe.com

RECOMMENDED

Domain

What it's used for

log-api.newrelic.com

Plugin logs (telemetry from both Revit plugins and their automatic updaters), so Support can troubleshoot

otlp.nr-data.net (port 4317)

Classic plugin logs (telemetry), so Support can troubleshoot

widget.intercom.io

Support chat and help

js.intercomcdn.com

Support chat and help

api-iam.intercom.io

Support chat and help

nexus-websocket-a.intercom.io

Support chat and help

help.pirros.com

Support chat and help

use.typekit.net

Fonts

p.typekit.net

Fonts

SAFE TO BLOCK (Analytics and in-App messages)

  • analytics.pirros.com

  • tracking.pirros.com

  • o4506780309848064.ingest.sentry.io

  • api-sr.amplitude.com

  • sr-client-cfg.amplitude.com

  • cdn.vitally.io

  • pirros.api.vitally.io

  • pirros.app.vitally.io

  • insights.algolia.io

  • cdn.jsdelivr.net

  • assets.customer.io

  • track.customer.io

  • code.gist.build

  • consumer.cloud.gist.build

Revit Plugin: Domains by Version

Pirros has two Revit plugins — Pirros in Revit (a docked panel) and the classic plugin — and they don't use exactly the same domains. Each plugin, and the automatic updater that keeps it current, contacts these domains from the lists above:

  • Pirros in Revit: app.pirros.com, api.pirros.com and auth.pirros.com. The panel is the Pirros web app running inside Revit, so it also needs the web app's sign-in, search and live-update domains. Live Link uses ws-us3.pusher.com. Plugin logs go to log-api.newrelic.com.

  • Classic plugin: api.pirros.com and auth.pirros.io (its sign-in window). Live Link uses ws-us3.pusher.com. The plugin's Pirros button opens app.pirros.com in your web browser. Plugin logs go to log-api.newrelic.com and otlp.nr-data.net (port 4317).

  • Automatic updater (runs in the background as the Windows SYSTEM account, whichever plugin you have): api.pirros.com, then the plugin installer storage listed under Installs, Updates, and Files. Its logs go to log-api.newrelic.com.

Certificate revocation checks: the automatic updater that comes with a 4.x installer checks the installer's digital signature before installing an update, including whether the signing certificate has been revoked. If the computer can't reach the certificate authority's revocation (CRL/OCSP) servers, the update isn't installed — so allow certificate revocation checks through your proxy or firewall. The updater that comes with a 3.x installer doesn't make this check.

Installing the Revit Plugin

The domains above cover signing in and using Pirros. If your firewall is blocking the plugin installer itself, see Revit Plugin: Download & Installation. Automatic plugin updates need the domains listed for the automatic updater above.

Still Having Trouble?

Reach out to our Support team through the chat in the bottom-right corner. Let us know which domains you've allowed and what the User sees, and we'll help you track down anything that's still blocked.

Did this answer your question?