Network Requirements
Overview
TinaCloud's authentication and content services communicate with several external domains. If your network uses a firewall, VPN, or proxy that restricts outbound traffic, you will need to whitelist the domains listed below to ensure TinaCMS functions correctly.
Required Domains
TinaCloud Services
Domain | Purpose |
|---|---|
| TinaCloud dashboard and asset delivery |
| Authentication and identity services (v1) |
| Authentication and identity services (v2). Required alongside |
| Content API and data layer |
| Asset management and delivery |
Authentication (OAuth / SSO)
TinaCloud uses AWS Cognito and API Gateway for authentication. The login flow redirects through these domains during sign-in:
Domain | Purpose |
|---|---|
| AWS Cognito hosted UI (OAuth authorization) |
| AWS Cognito Identity Provider API |
| AWS API Gateway (OIDC identity bridge) |
Media Uploads (S3)
When you upload media through the TinaCMS media manager, the dashboard receives a presigned URL from the assets API and PUTs the file directly to S3. The browser must be able to reach S3 for any media upload to succeed:
Domain | Purpose |
|---|---|
| Direct file uploads to TinaCloud's media bucket via presigned URL |
GitHub
If your project uses GitHub as its git provider (the default for TinaCloud):
Domain | Purpose |
|---|---|
| GitHub OAuth authorization and repository access |
| GitHub API for token exchange and user info |
Product Analytics (PostHog)
The TinaCMS admin UI emits product-analytics events via PostHog to help us improve the editor. On strict networks or CSPs you'll need to allow:
Domain | Purpose |
|---|---|
| PostHog event ingestion |
| PostHog runtime assets (autocapture, session recording, feature flags) — loaded lazily by |
Enterprise SSO (WorkOS)
If your organization uses enterprise SSO through TinaCloud:
Domain | Purpose |
|---|---|
| WorkOS enterprise SSO provider |
TinaCloud's Own IP Addresses
TinaCloud runs on AWS Lambda. Our services send their requests from the shared AWS address pool, and the address changes. We cannot give you an IP address or a CIDR range to add to an allow list.
Troubleshooting
Login times out on VPN or restricted network
If you see a "Login attempt timed out" error when authenticating from a VPN or restricted network, it is likely that one of the authentication domains listed above is being blocked. The sign-in flow must complete a full redirect chain within 20 seconds, and any blocked domain in that chain will cause a timeout.
Content Security Policy (CSP)
If you are configuring Content Security Policy headers for your site, see the CSP Configuration guide for the required directives.