Network Requirements

Overview

TinaCloud's authentication and content services communicate with several external domains. If your network uses a firewall, VPN, or proxy that restricts outbound traffic, you will need to whitelist the domains listed below to ensure TinaCMS functions correctly.

Required Domains

TinaCloud Services

Authentication (OAuth / SSO)

TinaCloud uses AWS Cognito and API Gateway for authentication. The login flow redirects through these domains during sign-in:

Media Uploads (S3)

When you upload media through the TinaCMS media manager, the dashboard receives a presigned URL from the assets API and PUTs the file directly to S3. The browser must be able to reach S3 for any media upload to succeed:

GitHub

If your project uses GitHub as its git provider (the default for TinaCloud):

Product Analytics (PostHog)

The TinaCMS admin UI emits product-analytics events via PostHog to help us improve the editor. On strict networks or CSPs you'll need to allow:

Enterprise SSO (WorkOS)

If your organization uses enterprise SSO through TinaCloud:

TinaCloud's Own IP Addresses

TinaCloud runs on AWS Lambda. Our services send their requests from the shared AWS address pool, and the address changes. We cannot give you an IP address or a CIDR range to add to an allow list.

Troubleshooting

If you see a "Login attempt timed out" error when authenticating from a VPN or restricted network, it is likely that one of the authentication domains listed above is being blocked. The sign-in flow must complete a full redirect chain within 20 seconds, and any blocked domain in that chain will cause a timeout.