Skip to main content

Documentation Index

Fetch the complete documentation index at: https://enterprise-docs.crewai.com/llms.txt

Use this file to discover all available pages before exploring further.

​
CrewAI Factory — Network Allowlist

Purpose: This document lists every external domain that a CrewAI Factory installation may contact. Use it to configure firewall rules, proxy allowlists, or egress network policies. Last updated: 2026-04-28

​
How to Read This Document

ColumnMeaning
Domain / PatternThe hostname or wildcard to allow
PortDefault destination port (443 unless noted)
ProtocolHTTPS, WSS, or both
DirectionEgress (cluster → internet) or Browser (end-user browser only)
Required?✅ = blocks install/runtime if missing · ⚙️ = required only when the feature is enabled · 🔌 = depends on customer’s chosen provider

​
1 · Critical Path — Blocks Installation

These domains are contacted during helm install and initial platform bootstrap. Blocking any of them will prevent installation.
DomainPortNotesRequired?
*.crewai.com443Helm chart OCI registry, container images, license & update checks✅
replicated.app443Replicated license verification✅
proxy.replicated.com443Image proxy backend✅
registry.replicated.com443OCI registry backend✅
pypi.crewaifactory.com443Private PyPI mirror for CrewAI packages✅
pypi.org443Public Python packages (fallback when not mirrored)✅
files.pythonhosted.org443Python package downloads✅
get.replicated.com443Embedded Cluster installer binary⚙️ EC only
github.com443Crew repos with git+https:// pip deps; crewAI-enterprise install⚙️

​
2 · Platform Runtime Services

These are first-party CrewAI services the platform communicates with at runtime.
DomainPortProtocolNotesRequired?
<your-application-host>443HTTPSOAuth integration proxy served via ingress path (e.g. <APPLICATION_HOST>/oauth/). No dedicated subdomain required.⚙️

​
3 · LLM Providers

Allow whichever providers your teams will use. The platform does not hardcode a single provider — customers choose which LLM APIs to connect.
Domain PatternProvider
api.openai.comOpenAI
api.anthropic.comAnthropic
generativelanguage.googleapis.comGoogle Gemini
*.openai.azure.comAzure OpenAI
bedrock-runtime.*.amazonaws.comAWS Bedrock
*-aiplatform.googleapis.comGoogle Vertex AI
api.cohere.aiCohere
api.groq.comGroq
api.cerebras.aiCerebras
api.sambanova.aiSambaNova
*.snowflakecomputing.comSnowflake Cortex
api-inference.huggingface.coHugging Face Inference
huggingface.coHugging Face (model downloads)
api.mistral.aiMistral
api.together.xyzTogether AI
api.fireworks.aiFireworks AI
api.replicate.comReplicate
api.deepseek.comDeepSeek
api.databricks.com / *.databricks.comDatabricks
api.deepinfra.comDeepInfra
Note: The built-in LLM (BUILT_IN_LLM_PROVIDER) defaults to OpenAI (gpt-4.1-mini). At minimum, allow the provider configured for the built-in LLM.

​
4 · Search, Scraping & Tool Providers

These are used by CrewAI tool integrations. Allow based on which tools your teams enable.
DomainTool / Service
serpapi.comSerpAPI
api.tavily.comTavily
api.firecrawl.devFirecrawl
api.linkup.soLinkUp
api.exa.aiExa
api.you.comYou.com
api.scrapingbee.comScrapingBee
api.scrapfly.ioScrapfly
api.brightdata.comBright Data
api.browserbase.comBrowserbase
api.hyperbrowser.aiHyperbrowser
api.brave.com / api.search.brave.comBrave Search
api.bing.microsoft.comBing Search
registry.smithery.aiSmithery MCP tool registry

​
5 · Vector Databases

Only required if your crews connect to managed vector database services. Allow based on which provider you use.
Domain PatternProvider
*.pinecone.ioPinecone
*.weaviate.io / *.weaviate.networkWeaviate
*.qdrant.ioQdrant
*.mongodb.netMongoDB Atlas

​
6 · Authentication & SSO

Allow the domain(s) for your chosen SSO provider. These are customer-specific.
ProviderDomains to Allow
Okta<your-org>.okta.com, <your-org>.oktapreview.com
Microsoft Entra IDlogin.microsoftonline.com, graph.microsoft.com
WorkOSapi.workos.com, <your-authkit-domain>
KeycloakYour self-hosted Keycloak URL
Google OAuthaccounts.google.com, oauth2.googleapis.com
GitHub OAuthgithub.com

​
7 · OAuth Integrations (Built-In Connectors)

If you enable built-in OAuth connectors for third-party services, allow the corresponding domains below. The OAuth proxy is served via an ingress path on your application host (see OAuth chart values) — no dedicated subdomain is required.
IntegrationDomains
Google Workspaceaccounts.google.com, oauth2.googleapis.com, www.googleapis.com, docs.google.com, drive.google.com, slides.google.com
Microsoft 365login.microsoftonline.com, graph.microsoft.com
HubSpotapi.hubspot.com, app.hubspot.com
Salesforcelogin.salesforce.com, *.salesforce.com
Notionapi.notion.so
Slackslack.com, api.slack.com
GitHubgithub.com, api.github.com

​
8 · Cloud Provider Services

Allow based on your deployment cloud. These are for object storage, secrets management, and identity federation from within the cluster.

​
AWS

Domain PatternService
s3.*.amazonaws.com / *.s3.amazonaws.comS3 object storage
secretsmanager.*.amazonaws.comSecrets Manager
logs.*.amazonaws.comCloudWatch Logs
sts.amazonaws.com / sts.*.amazonaws.comSTS (IAM role assumption)
rds.*.amazonaws.comRDS (if using RDS endpoint)
eks.*.amazonaws.comEKS API (kubeconfig update)

​
Azure

Domain PatternService
*.blob.core.windows.netBlob Storage
*.vault.azure.netKey Vault
*.postgres.database.azure.comAzure Database for PostgreSQL

​
GCP

Domain PatternService
storage.googleapis.comCloud Storage
secretmanager.googleapis.comSecret Manager
iamcredentials.googleapis.comWorkload Identity Federation
sts.googleapis.comSecurity Token Service
sqladmin.googleapis.comCloud SQL Admin (Cloud SQL Proxy)

​
Quick-Copy Allowlist

For convenience, here is a consolidated flat list of all mandatory + commonly-needed domains for a typical Factory deployment: 
# === CRITICAL (installation) ===
*.crewai.com
replicated.app
proxy.replicated.com
registry.replicated.com
pypi.crewaifactory.com
pypi.org
files.pythonhosted.org

# === LLM PROVIDERS (add as needed) ===
api.openai.com
api.anthropic.com
# ... add per your LLM choices

# === SSO (add your provider) ===
# login.microsoftonline.com  # Entra ID
# <org>.okta.com              # Okta
# api.workos.com              # WorkOS

​
Revision History

DateAuthorChanges
2026-04-28Iris (AI) / Diego Nogues (review)Initial version from FAC-50 source code audit