Skip to main content
This guide consolidates all technical setup requirements for IT teams deploying Speckle in enterprise environments. Share this page with your IT department to streamline approvals and configuration.
This page is scoped to IT administrative tasks only. For end-user guides, see Connector Installation and Workspace Management.

Connector Installation

Manual installation instructions and ZIP downloads

Cloud Integrations

Admin setup for ACC and ProjectWise integrations

SSO Setup

Configure Single Sign-On with your identity provider

Firewall Requirements

Network and firewall configuration requirements

Email Deliverability

IP allowlisting for system emails

Additional Resources

Support contacts and related documentation

​
Connector installation

Speckle connectors enable users to publish and load data from design applications like Revit, Rhino, and Archicad.
Connector updates work in two parts:
  • Desktop UI (DUI): Updated centrally and automatically propagates to all connectors without requiring connector updates. This shared interface handles authentication and common workflows.
  • Connector addons: Updated separately for each connector. Each application-specific connector (Revit, Rhino, etc.) must be updated individually.
When deploying connectors manually, you only need to update connector addons. DUI updates automatically. To prevent update checks, contact [email protected] for a file to replace the connector configuration database. A download link will be added to the manual installation guides in a future update.
Update cadence and approval processes:Speckle connectors are updated frequently to maintain compatibility with the evergreen Speckle server. Connectors are open source and can be inspected for security and compliance. If your organization requires approval for every software update, factor this frequent update cadence into your deployment process. Consider establishing a streamlined approval workflow or allowing automatic updates for patch releases.The Speckle server is also open source with delayed releases, allowing you to inspect changes before deployment if you’re running a self-hosted instance.

​
Standard installation

Users can download and install connectors directly from app.speckle.systems/connectors. Standard installers handle dependencies automatically and are recommended for most deployments. View Standard Installation Guide

​
Manual installation

For environments that restrict executable installers or require centralized deployment, use manual ZIP-based installation: The manual installation guide includes step-by-step instructions for all supported connectors, including the required Desktop Services background service.

​
Cloud integrations

​
Autodesk Forma Data Management (ACC)

Setup is user-led after the integration is enabled. IT Administrators enable the Speckle integration on the ACC Hub (Autodesk Forma Data Management admin). Once enabled, users sign in from Speckle workspace settings and follow the Forma Data Management integration guide for project syncing. Enable Autodesk Forma Data Management integration

​
Bentley ProjectWise

Setup is user-led after the integration is enabled. IT Administrators add the Speckle service account to each ProjectWise project users need to sync from. Once enabled, users sign in from Speckle workspace settings and follow the Bentley ProjectWise cloud integration guide. Enable Bentley ProjectWise integration

​
Bentley ProjectWise current limitations

Integration behavior depends on Bentley deployment and authentication setup. The points below describe current operational constraints for planning and rollout.
  • Best experience currently requires Bentley Infrastructure Cloud with Connected Projects.
  • Legacy or on-premise ProjectWise deployments may require additional Bentley-side configuration before full integration is possible.
  • Some deployments still rely on WSG and logical account authentication instead of IMS authentication.
  • IMS authentication is not yet universally available across all ProjectWise workflows and deployment types.
  • Authentication methods and API capabilities can vary between customer environments.
  • Automatic file change detection is limited in some scenarios, so scheduled polling may be used instead of event-driven webhooks.
  • Current integration scope is focused primarily on model and file synchronization workflows rather than broader document management.
  • Full IMS-native support across ProjectWise deployment types is still evolving.

​
Single sign-on (SSO)

Configure SSO to allow users to access Speckle using your organization’s existing identity provider. Speckle supports any OIDC identity provider.
SSO is available on the Enterprise plan.
View SSO Setup Guide The SSO setup guide includes the redirect URL, required scopes, grant type configuration, and identity provider setup steps.

​
Firewall and network requirements

Speckle requires outbound HTTPS connections to function. Allowlist the following domains and URLs to allow connectors, the web application, and API access.

​
Required domains

Allow outbound HTTPS (port 443) connections to:
For simplified firewall configuration, you can allowlist *.speckle.systems and *.speckle.dev to cover all Speckle domains. This includes current and future subdomains.
DomainPurposeRequired For
app.speckle.systemsMain API, web application, authenticationAll functionality
dashboards.speckle.systemsIntelligence dashboardsAnalytics and dashboards (optional)
docs.speckle.systemsDocumentationReference access (optional)
dui.speckle.systemsDesktop UI updates and componentsConnector functionality
releases.speckle.systemsManual connector ZIP downloadsManual installation
releases.speckle.devConnector feed dataConnector update checks
speckle.communitySupport forum, community resourcesSupport access (optional)
www.speckle.systemsConnector downloads, documentationConnector installation
*.digitaloceanspaces.comFile storage and uploadsFile uploads
The dashboards.speckle.systems domain is hosted on Netlify infrastructure during beta. If you encounter connectivity issues, contact [email protected] for current hosting details.

​
API endpoints

The following endpoints must be accessible for full functionality: GraphQL API:
  • https://app.speckle.systems/graphql
REST API:
  • https://app.speckle.systems/api/v1/*
Authentication:
  • https://app.speckle.systems/api/v1/auth/*
  • https://app.speckle.systems/api/v1/workspaces/*/sso/oidc/callback (for SSO)
WebSocket (for real-time features):
  • Allow WebSocket connections (WSS) to app.speckle.systems for real-time features in the web application
File uploads:
  • File uploads use presigned S3 URLs that are generated dynamically. These are typically served through app.speckle.systems or associated CDN endpoints. If you encounter issues with file uploads, ensure app.speckle.systems and its associated CDN domains (including *.digitaloceanspaces.com) are fully allowlisted.

​
Self-hosted servers

If your organization uses a self-hosted Speckle server, replace app.speckle.systems with your server’s domain in all URLs above. Ensure your server domain is allowlisted and accessible from user workstations.
For self-hosted deployments, see the Server Deployment Guide for infrastructure requirements.

​
Port requirements

  • Outbound HTTPS: Port 443 (required)
  • Outbound HTTP: Port 80 (optional, for redirects only)
  • WebSocket: Port 443 (WSS, required for real-time features)

​
Regional considerations

app.speckle.systems is served through Cloudflare, which uses a global CDN with dynamic IP addresses that change frequently. For this reason, domain-based firewall rules are strongly recommended over IP-based rules. If your organization requires IP-based firewall rules, you can refer to Cloudflare’s published IP ranges. However, these ranges are large and change regularly, making domain-based rules more reliable and easier to maintain.
For the most current IP ranges or assistance with firewall configuration, contact [email protected].
For organizations with strict egress controls, consider deploying a self-hosted Speckle server to keep all traffic within your network.

​
Email deliverability: IP allowlisting

To ensure reliable delivery of system emails (notifications, alerts, reports, etc.), customers with strict email security policies may need to allowlist the IP ranges used by our email delivery provider. If your organization uses email gateways, spam filters, or firewall rules that restrict incoming email traffic, add the following IP ranges to your allowlist.

​
Sending IP ranges

  • 205.201.128.0/20
  • 198.2.128.0/18
  • 148.105.0.0/16

​
What this means

These CIDR ranges are used by our email service provider to send outbound messages. Allowlisting them helps ensure that messages from our platform are not blocked or quarantined by your email security infrastructure.

​
Who should configure this

This is typically configured by your:
  • Email administrators
  • IT or security team
  • Network or firewall administrators

​
Where to add the allowlist

Depending on your environment, the IP ranges may need to be added to:
  • Email security gateways (e.g., Proofpoint, Mimecast, Barracuda)
  • Spam filtering systems
  • Microsoft 365 / Exchange mail flow rules
  • Google Workspace allowlists
  • Network firewalls or secure email gateways
Add these ranges to your trusted sender or inbound allowlist policies to prevent email filtering or blocking.
These IP ranges are maintained by our email provider and may change periodically. If your organization requires domain-based allowlisting instead, contact [email protected].

​
Additional resources

​
Support

​
FAQ

Product SLA terms depend on your plan and contract. Enterprise customers should refer to their commercial agreement for any uptime or availability commitments.
Support SLA terms depend on your plan and contract. If your organization has an Enterprise agreement, refer to that agreement for response-time and escalation commitments.
SLA commitments are typically defined in your commercial agreement rather than a public one-size-fits-all page. Contact [email protected] if you need your current SLA terms confirmed.
Both. The in-app chat is powered by Intercom FinAI for first-line responses. It is informed by Speckle documentation, previous support interactions, and public open-source repositories. Human support engineers review, follow up, and handle complex or escalated cases.
Yes. Connectors require access to app.speckle.systems for authentication and data transfer. The web application also requires access to the same domain. Allowlist app.speckle.systems for both use cases.
Some firewalls require separate configuration to allow non-browser applications to access domains. Even when ports 443 and 80 are open, firewall rules may block applications like connectors that aren’t web browsers. Configure your firewall to allow outbound HTTPS connections from all applications, not just browsers, or create specific rules for the connector executables.
We strongly recommend using domain names. app.speckle.systems is served through Cloudflare, which uses a global CDN with dynamic IP addresses that change frequently. Domain-based rules are more reliable and easier to maintain. If IP-based rules are required, refer to Cloudflare’s published IP ranges or contact support for assistance.
Connectors support HTTP proxies configured at the system level. Ensure proxy settings allow HTTPS connections to app.speckle.systems. Authentication may require interactive browser sessions.
WebSocket connections are used for real-time features in the web application. Connectors will function without WebSocket access, but some web app features may be limited.
No. Connectors require internet access to authenticate users and transfer data. For air-gapped environments, deploy a self-hosted Speckle server within your network.
Last modified on May 6, 2026