> ## Documentation Index
> Fetch the complete documentation index at: https://docs.openwhispr.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Network allowlist
> Every host the OpenWhispr desktop app contacts, for firewall, proxy and DNS-filter configuration.
This is the page to hand your IT team. It lists every outbound host the
OpenWhispr desktop app contacts, why, and whether it's optional.
All connections are client-initiated over TLS on port 443. A few components
— the CLI bridge, an auth bridge, an OAuth callback catcher, and local model
servers when you use them — listen on `127.0.0.1` for the app's own pieces to
talk to each other. One exception: the bundled Parakeet speech server can't
bind loopback-only, so on Windows it listens on all interfaces until the
installer's firewall rule closes it off — see [antivirus and firewall
prompts](/help/fix/antivirus-blocks-openwhispr).
## Required by default
Contacted by every install using OpenWhispr Cloud, which is the default after
onboarding.
| Host | Protocol | Purpose |
| --------------------------------------------- | -------- | ----------------------------------------------------------------- |
| `api.openwhispr.com` | HTTPS | Cloud API — transcription, sync, agent reasoning, settings, usage |
| `auth.openwhispr.com` | HTTPS | Account sign-in and session refresh |
| `github.com`, `objects.githubusercontent.com` | HTTPS | Application auto-update (release artifacts) |
## Streaming transcription
Streaming sessions are routed through one of three providers. Allowlist all
three unless a specific provider is pinned in your configuration.
| Host | Protocol | Purpose |
| -------------------------- | ---------- | ------------------------------------------------------------- |
| `api.deepgram.com` | WSS | Deepgram streaming transcription |
| `api.openai.com` | WSS, HTTPS | OpenAI Realtime streaming transcription |
| `streaming.assemblyai.com` | WSS, HTTPS | AssemblyAI streaming — token endpoint HTTPS, live session WSS |
## Local model downloads
Contacted only when someone opts into a local model — Whisper, Parakeet, or a
local reasoning model. Not needed for cloud-only installs.
| Host | Protocol | Purpose |
| ------------------------------------------------------- | -------- | ------------------------------------------------------- |
| `huggingface.co` | HTTPS | Model downloads |
| `cdn-lfs.huggingface.co`, `cdn-lfs-us-1.huggingface.co` | HTTPS | Large-file CDN for model files |
| `github.com`, `objects.githubusercontent.com` | HTTPS | sherpa-onnx, llama.cpp, whisper.cpp and Qdrant binaries |
## Google Calendar (optional)
Only if a user connects Google Calendar in settings.
| Host | Protocol | Purpose |
| ----------------------- | -------- | -------------------------------------- |
| `accounts.google.com` | HTTPS | OAuth authorisation |
| `oauth2.googleapis.com` | HTTPS | OAuth token exchange and revoke |
| `www.googleapis.com` | HTTPS | Calendar event and calendar-list reads |
| `openwhispr.com` | HTTPS | OAuth desktop callback redirect |
## URL audio import (optional)
Only when a user pastes a URL into the Upload view. Downloads are HTTPS-only,
and hosts resolving to private or internal addresses are rejected.
| Host | Protocol | Purpose |
| ---------------------------------------------------------------------------------- | -------- | ------------------------------------------------------------------------ |
| `www.youtube.com`, `youtube.com`, `youtu.be`, `m.youtube.com`, `music.youtube.com` | HTTPS | YouTube page and metadata fetch |
| `*.googlevideo.com` | HTTPS | YouTube media CDN — the audio stream itself |
| *user-pasted hosts* | HTTPS | Direct audio or video URL imports contact whatever public host is pasted |
## Bring-your-own-key providers (optional)
Required only where a user has configured their own API key. Skip any provider
not in use.
| Host | Protocol | Used when |
| -------------------------------------------------------------------------------- | ---------- | ---------------------------------------------- |
| `api.openai.com` | HTTPS | OpenAI key configured |
| `*.cognitiveservices.azure.com`, `*.openai.azure.com`, `*.services.ai.azure.com` | HTTPS | Azure AI Foundry / Azure OpenAI speech-to-text |
| `api.anthropic.com` | HTTPS | Anthropic key configured |
| `generativelanguage.googleapis.com` | HTTPS | Gemini key configured |
| `api.groq.com` | HTTPS | Groq key configured |
| `atc.tinfoil.sh`, `*.tinfoil.sh` | WSS, HTTPS | Tinfoil key configured |
| `api.mistral.ai` | HTTPS | Mistral key configured |
| `openrouter.ai` | HTTPS | OpenRouter selected as a reasoning provider |
| `api.x.ai` | HTTPS | xAI (Grok) key configured |
| `ai.eu.corti.app` | HTTPS | Corti key configured |
Tinfoil assigns an enclave host dynamically at runtime, so allowlist
`*.tinfoil.sh` rather than pinning individual hosts. `atc.tinfoil.sh` serves
the attestation bundle, which is verified locally.
## Notes for network administrators
* **Proxies are honoured.** The app uses Electron's network stack, which follows
system proxy settings — macOS System Settings, Windows Internet Options and
WPAD, GNOME proxy — and PAC scripts on all platforms.
* **IP pinning is not supported.** These hosts resolve to provider-managed
addresses that change without notice. Allowlist by hostname.
* **TLS interception needs its root trusted by the OS.** Otherwise connections
fail with certificate errors.
* **Minimal Linux containers** without a system CA bundle — Alpine, distroless —
need `NODE_EXTRA_CA_CERTS` set to your CA bundle path.
### What the failures look like
| Symptom | Cause |
| ----------------------------------------------------- | ---------------------------------------------------------------------------- |
| `ENOTFOUND` | DNS is filtered — a resolver, filter or ad blocker is blocking the domain |
| `ECONNREFUSED` / `ETIMEDOUT` | A firewall is blocking the host or port |
| `CERT_HAS_EXPIRED`, `UNABLE_TO_VERIFY_LEAF_SIGNATURE` | A TLS-intercepting proxy is in the path and its root isn't trusted by the OS |
## Testing the path
Run these from a machine on the same network as the user. **Any** HTTP response
— including `401` — confirms the network path works.
```sh theme={null}
# OpenWhispr Cloud reachability
curl -v https://api.openwhispr.com/api/health
# Streaming providers
curl -v https://api.deepgram.com/v1/projects
curl -v https://api.openai.com/v1/models
curl -v https://streaming.assemblyai.com/v3/token
# Model downloads, only if local mode is in use
curl -v -I https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-tiny.bin
```
## Related
* [Can't reach OpenWhispr Cloud](/help/fix/cant-reach-openwhispr-cloud)
* [A model won't download](/help/fix/model-download-fails)
* [Enterprise](/guides/enterprise)