IT setup guide

This guide consolidates all technical setup requirements for IT teams deploying Speckle in enterprise environments. Share this page with your IT department for approvals and configuration.

​

2026.9 dates and actions

2026.9 moves Speckle to a new data model. It does not change how you install connectors, configure SSO, or enable ACC and ProjectWise. Two dated actions apply to your organization: Speckle does not guarantee that connectors from 2026.8 or earlier keep working after the window closes, so upgrade. Models already published stay readable. Compatibility mode applies only to cloud syncs and file uploads, not to desktop connectors. For the summary for workspace members, see Speckle’s new data model.

​

Connector installation

Speckle connectors enable users to publish and load data from design applications like Revit, Rhino, and Archicad. Connector updates work in two parts:

• Desktop UI (DUI): Updated centrally and automatically propagates to all connectors without requiring connector updates. This shared interface handles authentication and common workflows.
• Connector addons: Updated separately for each connector. Each application-specific connector (Revit, Rhino, etc.) must be updated individually.

When deploying connectors manually, you only need to update connector addons. DUI updates automatically. Speckle connectors are updated frequently to stay compatible with the continuously updated Speckle server. Connectors are open source and can be inspected for security and compliance. If your organization requires approval for every software update, factor this frequent update cadence into your deployment process: consider a faster approval workflow or allowing automatic updates for patch releases.

​

Standard installation

Users can download and install connectors directly from app.speckle.systems/connectors. Standard installers handle dependencies automatically and are recommended for most deployments. View Standard Installation Guide

​

Manual installation

For environments that restrict executable installers or require centralized deployment, use manual ZIP-based installation:

• Download ZIP files: releases.speckle.systems
• Installation instructions: Manual Installation Guide

The manual installation guide includes step-by-step instructions for all supported connectors. Current connector versions do not need the Desktop Services background service; the manual installation pages state which older versions did.

​

Cloud integrations

Before enabling any integration, read Cloud Integrations: Access and Governance — it explains which identity each integration acts as and where the access boundary is set.

​

Autodesk Forma Data Management (ACC)

Setup is user-led after the integration is enabled. IT Administrators enable the Speckle integration on the ACC Hub (Autodesk Forma Data Management admin). Once enabled, users connect from a project’s Integrations → ACC page and follow the Forma Data Management integration guide for project syncing. Enable Autodesk Forma Data Management integration

​

Bentley ProjectWise

Speckle supports two ProjectWise connections:

• Cloud uses Bentley IMS. Add the Speckle service account to each Bentley project users need to sync.
• On-Prem connects directly to WSG v2.9. Enable Native Authentication and make the WSG endpoint reachable from the Speckle backend.

Users complete the connection from their Speckle project after IT prepares the selected environment. Configure Bentley ProjectWise integration

​

Trimble Connect

Trimble Connect has no hub-level enablement step. A workspace admin connects a dedicated Trimble service account from a project’s Integrations → Trimble Connect page, and invites that account to every Trimble Connect project users need to sync. Sync models from Trimble Connect

​

SharePoint

A Microsoft admin approves Speckle’s app once for your Microsoft 365 organization. Until then, nobody in the organization can sign in to SharePoint from Speckle. After the approval, members connect from a project’s Integrations → SharePoint page. Approve Speckle for SharePoint

​

Single sign-on (SSO)

Configure SSO to allow users to access Speckle using your organization’s existing identity provider. Speckle supports any OIDC identity provider. View SSO Setup Guide The SSO setup guide includes the redirect URL, required scopes, grant type configuration, and identity provider setup steps.

​

Turn AI features off for the workspace

A workspace admin can turn AI features off for the whole workspace from workspace Settings, then General. Members and guests can open the General page but cannot change the switch. When AI features are off, Chat and the sparkle control in the 3D viewer are unavailable to everyone in the workspace, so nobody can start a conversation or spend AI credit. Turn the switch back on the same way to restore access. The switch is a workspace setting. If your organization runs several workspaces, turn AI features off in each one.

​

Enterprise controls for AI

On the Enterprise and Unlimited plans, the AI card in Settings, then General, also shows two more switches. Both are off by default. Only workspace admins can change them. Members see the switches but cannot change them, and on other plans the switches are disabled.

• Only workspace admins can enable AI: members can no longer accept the AI terms for the workspace. A member who tries sees a Contact your workspace admin dialog that says “A workspace admin must enable AI for this workspace”. An admin then enables AI for the workspace.
• Disable public sharing of AI conversations: nobody can create a new public link to an AI conversation, and existing public links stop working at once. Members can still share a conversation with signed-in project members.

If the workspace moves to a lower plan, the values you set stay in force, but you cannot change them until the workspace is back on Enterprise or Unlimited. For the rest of workspace Settings, see Configuration. For activity, plan limits, and AI spend, see Usage statistics. Organization playbooks for Intelligence are skills, and standing constraints on every conversation are AI Rules.

​

Firewall and network requirements

Speckle requires outbound HTTPS connections to function. Allowlist the following domains and URLs to allow connectors, the web application, and API access.

​

Required domains

Allow outbound HTTPS (port 443) connections to:

​

API endpoints

The following endpoints must be accessible for full functionality: GraphQL API:

• https://app.speckle.systems/graphql

REST API:

• https://app.speckle.systems/api/v1/*

Authentication:

• https://app.speckle.systems/api/v1/auth/*
• https://app.speckle.systems/api/v1/workspaces/*/sso/oidc/callback (for SSO)

WebSocket (for real-time features):

• Allow WebSocket connections (WSS) to app.speckle.systems for real-time features in the web application

File storage:

• Publishing and loading models, and file uploads, use presigned URLs on *.digitaloceanspaces.com (for example ams3.digitaloceanspaces.com). Connectors and browsers connect to these hosts directly, not through app.speckle.systems. If you encounter issues, ensure app.speckle.systems and *.digitaloceanspaces.com are fully allowlisted.
• If your network inspects or re-signs HTTPS traffic (TLS/SSL inspection, common with VPNs and secure web gateways), exclude these domains from inspection. Allowlisting alone is not enough. The usual symptom is that a connector signs in and lists projects, but publishing or loading fails with certificate verify failed.

​

Self-hosted servers

If your organization uses a self-hosted Speckle server, replace app.speckle.systems with your server’s domain in all URLs above. Ensure your server domain is allowlisted and accessible from user workstations.

​

Port requirements

• Outbound HTTPS: Port 443 (required)
• Outbound HTTP: Port 80 (optional, for redirects only)
• WebSocket: Port 443 (WSS, required for real-time features)

​

Regional considerations

app.speckle.systems is served through Cloudflare, which uses a global CDN with dynamic IP addresses that change frequently. For this reason, domain-based firewall rules are strongly recommended over IP-based rules. If your organization requires IP-based firewall rules, you can refer to Cloudflare’s published IP ranges. However, these ranges are large and change regularly, making domain-based rules more reliable and easier to maintain.

​

Email deliverability: IP allowlisting

To ensure reliable delivery of system emails (notifications, alerts, reports, etc.), customers with strict email security policies may need to allowlist the IP ranges used by our email delivery provider. If your organization uses email gateways, spam filters, or firewall rules that restrict incoming email traffic, add the following IP ranges to your allowlist.

​

Sending IP ranges

• 205.201.128.0/20
• 198.2.128.0/18
• 148.105.0.0/16

​

What this means

These CIDR ranges are used by our email service provider to send outbound messages. Allowlisting them helps ensure that messages from our platform are not blocked or quarantined by your email security infrastructure.

​

Who should configure this

This is typically configured by your:

• Email administrators
• IT or security team
• Network or firewall administrators

​

Where to add the allowlist

Depending on your environment, the IP ranges may need to be added to:

• Email security gateways (e.g., Proofpoint, Mimecast, Barracuda)
• Spam filtering systems
• Microsoft 365 / Exchange mail flow rules
• Google Workspace allowlists
• Network firewalls or secure email gateways

​

Additional resources

​

Support

• Email: [email protected]
• Community Forum: speckle.community
• SSO Setup Assistance: We offer guided SSO configuration calls. Contact us to schedule.

​

Related documentation

• Connector Installation (User Guide)
• Manual Connector Installation
• Connector Updates (choosing a target version, host support, known conflicts)
• SSO Configuration
• Server Deployment Guide (for self-hosted deployments)

​

FAQ