Skip to main content
This guide consolidates all technical setup requirements for IT teams deploying Speckle in enterprise environments. Share this page with your IT department to streamline approvals and configuration.
This page is scoped to IT administrative tasks only. For end-user guides, see Connector Installation and Workspace Management.

Connector Installation

Manual installation instructions and ZIP downloads

SSO Setup

Configure Single Sign-On with your identity provider

Firewall Requirements

Network and firewall configuration requirements

Additional Resources

Support contacts and related documentation

​
Connector Installation

Speckle connectors enable users to publish and load data from design applications like Revit, Rhino, and Archicad.
Connector updates work in two parts:
  • Desktop UI (DUI): Updated centrally and automatically propagates to all connectors without requiring connector updates. This shared interface handles authentication and common workflows.
  • Connector addons: Updated separately for each connector. Each application-specific connector (Revit, Rhino, etc.) must be updated individually.
When deploying connectors manually, you only need to update connector addons. DUI updates automatically. To prevent update checks, contact [email protected] for a file to replace the connector configuration database. A download link will be available in the manual installation guides in future.
Update cadence and approval processes:Speckle connectors are updated frequently to maintain compatibility with the evergreen Speckle server. Connectors are open source and can be inspected for security and compliance. If your organization requires approval for every software update, factor this frequent update cadence into your deployment process. Consider establishing a streamlined approval workflow or allowing automatic updates for patch releases.The Speckle server is also open source with delayed releases, allowing you to inspect changes before deployment if you’re running a self-hosted instance.

​
Standard Installation

Users can download and install connectors directly from app.speckle.systems/connectors. Standard installers handle dependencies automatically and are recommended for most deployments. View Standard Installation Guide

​
Manual Installation

For environments that restrict executable installers or require centralized deployment, use manual ZIP-based installation: The manual installation guide includes step-by-step instructions for all supported connectors, including the required Desktop Services background service.

​
Autodesk Construction Cloud (ACC)

ACC setup is user-led after the integration is enabled. IT Administrators are responsible for enabling the Speckle integration on the ACC Hub. Once enabled, users sign in from Speckle workspace settings and follow the ACC integration guide for project syncing. Enable the integration on ACC (step-by-step)

​
Single Sign-On (SSO)

Configure SSO to allow users to access Speckle using your organization’s existing identity provider. Speckle supports any OIDC identity provider.
SSO is available on the Enterprise plan.
View SSO Setup Guide The SSO setup guide includes the redirect URL, required scopes, grant type configuration, and identity provider setup steps.

​
Firewall and Network Requirements

Speckle requires outbound HTTPS connections to function. Allowlist the following domains and URLs to allow connectors, the web application, and API access.

​
Required Domains

Allow outbound HTTPS (port 443) connections to:
For simplified firewall configuration, you can allowlist *.speckle.systems and *.speckle.dev to cover all Speckle domains. This includes current and future subdomains.
DomainPurposeRequired For
app.speckle.systemsMain API, web application, authenticationAll functionality
dashboards.speckle.systemsIntelligence dashboardsAnalytics and dashboards (optional)
docs.speckle.systemsDocumentationReference access (optional)
dui.speckle.systemsDesktop UI updates and componentsConnector functionality
releases.speckle.systemsManual connector ZIP downloadsManual installation
releases.speckle.devConnector feed dataConnector update checks
speckle.communitySupport forum, community resourcesSupport access (optional)
www.speckle.systemsConnector downloads, documentationConnector installation
*.digitaloceanspaces.comFile storage and uploadsFile uploads
The dashboards.speckle.systems domain is hosted on Netlify infrastructure during beta. If you encounter connectivity issues, contact [email protected] for current hosting details.

​
API Endpoints

The following endpoints must be accessible for full functionality: GraphQL API:
  • https://app.speckle.systems/graphql
REST API:
  • https://app.speckle.systems/api/v1/*
Authentication:
  • https://app.speckle.systems/api/v1/auth/*
  • https://app.speckle.systems/api/v1/workspaces/*/sso/oidc/callback (for SSO)
WebSocket (for real-time features):
  • Allow WebSocket connections (WSS) to app.speckle.systems for real-time features in the web application
File uploads:
  • File uploads use presigned S3 URLs that are generated dynamically. These are typically served through app.speckle.systems or associated CDN endpoints. If you encounter issues with file uploads, ensure app.speckle.systems and its associated CDN domains (including *.digitaloceanspaces.com) are fully allowlisted.

​
Self-Hosted Servers

If your organization uses a self-hosted Speckle server, replace app.speckle.systems with your server’s domain in all URLs above. Ensure your server domain is allowlisted and accessible from user workstations.
For self-hosted deployments, see the Server Deployment Guide for infrastructure requirements.

​
Port Requirements

  • Outbound HTTPS: Port 443 (required)
  • Outbound HTTP: Port 80 (optional, for redirects only)
  • WebSocket: Port 443 (WSS, required for real-time features)

​
Regional Considerations

app.speckle.systems is served through Cloudflare, which uses a global CDN with dynamic IP addresses that change frequently. For this reason, domain-based firewall rules are strongly recommended over IP-based rules. If your organization requires IP-based firewall rules, you can reference Cloudflare’s published IP ranges. However, these ranges are large and change regularly, making domain-based rules more reliable and easier to maintain.
For the most current IP ranges or assistance with firewall configuration, contact [email protected].
For organizations with strict egress controls, consider deploying a self-hosted Speckle server to keep all traffic within your network.

​
Additional Resources

​
Support

​
FAQ

Yes. Connectors require access to app.speckle.systems for authentication and data transfer. The web application also requires access to the same domain. Allowlist app.speckle.systems for both use cases.
Some firewalls require separate configuration to allow non-browser applications to access domains. Even when ports 443 and 80 are open, firewall rules may block applications like connectors that aren’t web browsers. Configure your firewall to allow outbound HTTPS connections from all applications, not just browsers, or create specific rules for the connector executables.
We strongly recommend using domain names. app.speckle.systems is served through Cloudflare, which uses a global CDN with dynamic IP addresses that change frequently. Domain-based rules are more reliable and easier to maintain. If IP-based rules are required, reference Cloudflare’s published IP ranges or contact support for assistance.
Connectors support HTTP proxies configured at the system level. Ensure proxy settings allow HTTPS connections to app.speckle.systems. Authentication may require interactive browser sessions.
WebSocket connections are used for real-time features in the web application. Connectors will function without WebSocket access, but some web app features may be limited.
No. Connectors require internet access to authenticate users and transfer data. For air-gapped environments, deploy a self-hosted Speckle server within your network.
Last modified on February 25, 2026