> ## Documentation Index
> Fetch the complete documentation index at: https://docs.speckle.systems/llms.txt
> Use this file to discover all available pages before exploring further.

# IT Setup Guide

> Complete setup resources for IT administrators deploying Speckle in enterprise environments

This guide consolidates all technical setup requirements for IT teams deploying Speckle in enterprise environments. Share this page with your IT department to streamline approvals and configuration.

<Note>
  This page is scoped to IT administrative tasks only. For end-user guides, see [Connector
  Installation](/connectors/installation) and [Workspace Management](/workspaces/introduction).
</Note>

<CardGroup cols={2}>
  <Card title="Connector Installation" icon="download" href="#connector-installation">
    Manual installation instructions and ZIP downloads
  </Card>

  <Card title="Cloud Integrations" icon="cloud" href="#cloud-integrations">
    Admin setup for ACC and ProjectWise integrations
  </Card>

  <Card title="SSO Setup" icon="lock" href="/workspaces/sso">
    Configure Single Sign-On with your identity provider
  </Card>

  <Card title="Firewall Requirements" icon="shield" href="#firewall-and-network-requirements">
    Network and firewall configuration requirements
  </Card>

  <Card title="Email Deliverability" icon="envelope" href="#email-deliverability-ip-allowlisting">
    IP allowlisting for system emails
  </Card>

  <Card title="Additional Resources" icon="book" href="#additional-resources">
    Support contacts and related documentation
  </Card>
</CardGroup>

## Connector installation

Speckle connectors enable users to publish and load data from design applications like Revit, Rhino, and Archicad.

<Warning>
  Connector updates work in two parts:

  * **Desktop UI (DUI)**: Updated centrally and automatically propagates to all connectors without requiring connector updates. This shared interface handles authentication and common workflows.
  * **Connector addons**: Updated separately for each connector. Each application-specific connector (Revit, Rhino, etc.) must be updated individually.

  When deploying connectors manually, you only need to update connector addons. DUI updates automatically. To prevent update checks, contact [support@speckle.systems](mailto:support@speckle.systems) for a file to replace the connector configuration database. A download link will be added to the manual installation guides in a future update.
</Warning>

<Note>
  Update cadence and approval processes:
  Speckle connectors are updated frequently to maintain compatibility with the evergreen Speckle server. Connectors are open source and can be inspected for security and compliance. If your organization requires approval for every software update, factor this frequent update cadence into your deployment process. Consider establishing a streamlined approval workflow or allowing automatic updates for patch releases.

  The Speckle server is also open source with delayed releases, allowing you to inspect changes before deployment if you're running a self-hosted instance.
</Note>

### Standard installation

Users can download and install connectors directly from [app.speckle.systems/connectors](https://app.speckle.systems/connectors). Standard installers handle dependencies automatically and are recommended for most deployments.

[View Standard Installation Guide](/connectors/installation)

### Manual installation

For environments that restrict executable installers or require centralized deployment, use manual ZIP-based installation:

* **Download ZIP files:** <a href="https://releases.speckle.systems/" rel="nofollow">releases.speckle.systems</a>
* **Installation instructions:** [Manual Installation Guide](/connectors/manual-installation/introduction)

The manual installation guide includes step-by-step instructions for all supported connectors, including the required Desktop Services background service.

## Cloud integrations

### Autodesk Forma Data Management (ACC)

Setup is user-led after the integration is enabled. **IT Administrators** enable the Speckle integration on the **ACC Hub** (Autodesk Forma Data Management admin). Once enabled, users sign in from Speckle workspace settings and follow the [Forma Data Management integration guide](/connectors/cloud-integrations/acc) for project syncing.

[Enable Autodesk Forma Data Management integration](/workspaces/it-admin-acc-integration)

### Bentley ProjectWise

Speckle supports two ProjectWise connections:

* **Cloud** uses Bentley IMS. Add the Speckle service account to each Bentley project users need to sync.
* **On-Prem** connects directly to WSG v2.9. Enable Native Authentication and make the WSG endpoint reachable from the Speckle backend.

Users complete the connection from their Speckle project after IT prepares the selected environment.

[Configure Bentley ProjectWise integration](/workspaces/it-admin-projectwise-integration)

<Note>
  ProjectWise updates are detected by scheduled checks. The integration is read-only and focuses on
  model and file synchronization rather than general document management.
</Note>

## Single sign-on (SSO)

Configure SSO to allow users to access Speckle using your organization's existing identity provider. Speckle supports any OIDC identity provider.

<Note>SSO is available on the Enterprise plan.</Note>

[View SSO Setup Guide](/workspaces/sso)

The SSO setup guide includes the redirect URL, required scopes, grant type configuration, and identity provider setup steps.

## Firewall and network requirements

Speckle requires outbound HTTPS connections to function. Allowlist the following domains and URLs to allow connectors, the web application, and API access.

### Required domains

Allow outbound HTTPS (port 443) connections to:

<Tip>
  For simplified firewall configuration, you can allowlist `*.speckle.systems` and `*.speckle.dev`
  to cover all Speckle domains. This includes current and future subdomains.
</Tip>

| Domain                       | Purpose                                   | Required For                        |
| ---------------------------- | ----------------------------------------- | ----------------------------------- |
| `app.speckle.systems`        | Main API, web application, authentication | All functionality                   |
| `dashboards.speckle.systems` | Intelligence dashboards                   | Analytics and dashboards (optional) |
| `docs.speckle.systems`       | Documentation                             | Reference access (optional)         |
| `dui.speckle.systems`        | Desktop UI updates and components         | Connector functionality             |
| `releases.speckle.systems`   | Manual connector ZIP downloads            | Manual installation                 |
| `releases.speckle.dev`       | Connector feed data                       | Connector update checks             |
| `speckle.community`          | Support forum, community resources        | Support access (optional)           |
| `www.speckle.systems`        | Connector downloads, documentation        | Connector installation              |
| `*.digitaloceanspaces.com`   | File storage and uploads                  | File uploads                        |

<Note>
  The `dashboards.speckle.systems` domain is hosted on Netlify infrastructure during beta. If you
  encounter connectivity issues, contact [support@speckle.systems](mailto:support@speckle.systems)
  for current hosting details.
</Note>

### API endpoints

The following endpoints must be accessible for full functionality:

GraphQL API:

* `https://app.speckle.systems/graphql`

REST API:

* `https://app.speckle.systems/api/v1/*`

Authentication:

* `https://app.speckle.systems/api/v1/auth/*`
* `https://app.speckle.systems/api/v1/workspaces/*/sso/oidc/callback` (for SSO)

WebSocket (for real-time features):

* Allow WebSocket connections (WSS) to `app.speckle.systems` for real-time features in the web application

File uploads:

* File uploads use presigned S3 URLs that are generated dynamically. These are typically served through `app.speckle.systems` or associated CDN endpoints. If you encounter issues with file uploads, ensure `app.speckle.systems` and its associated CDN domains (including `*.digitaloceanspaces.com`) are fully allowlisted.

### Self-hosted servers

If your organization uses a self-hosted Speckle server, replace `app.speckle.systems` with your server's domain in all URLs above. Ensure your server domain is allowlisted and accessible from user workstations.

<Info>
  For self-hosted deployments, see the [Server Deployment Guide](/developers/server/getting-started)
  for infrastructure requirements.
</Info>

### Port requirements

* **Outbound HTTPS:** Port 443 (required)
* **Outbound HTTP:** Port 80 (optional, for redirects only)
* **WebSocket:** Port 443 (WSS, required for real-time features)

### Regional considerations

`app.speckle.systems` is served through Cloudflare, which uses a global CDN with dynamic IP addresses that change frequently. For this reason, domain-based firewall rules are strongly recommended over IP-based rules.

If your organization requires IP-based firewall rules, you can refer to [Cloudflare's published IP ranges](https://www.cloudflare.com/ips/). However, these ranges are large and change regularly, making domain-based rules more reliable and easier to maintain.

<Info>
  For the most current IP ranges or assistance with firewall configuration, contact
  [support@speckle.systems](mailto:support@speckle.systems).
</Info>

<Note>
  For organizations with strict egress controls, consider deploying a self-hosted Speckle server to
  keep all traffic within your network.
</Note>

## Email deliverability: IP allowlisting

To ensure reliable delivery of system emails (notifications, alerts, reports, etc.), customers with strict email security policies may need to allowlist the IP ranges used by our email delivery provider.

If your organization uses email gateways, spam filters, or firewall rules that restrict incoming email traffic, add the following IP ranges to your allowlist.

### Sending IP ranges

* `205.201.128.0/20`
* `198.2.128.0/18`
* `148.105.0.0/16`

### What this means

These CIDR ranges are used by our email service provider to send outbound messages. Allowlisting them helps ensure that messages from our platform are not blocked or quarantined by your email security infrastructure.

### Who should configure this

This is typically configured by your:

* Email administrators
* IT or security team
* Network or firewall administrators

### Where to add the allowlist

Depending on your environment, the IP ranges may need to be added to:

* Email security gateways (e.g., Proofpoint, Mimecast, Barracuda)
* Spam filtering systems
* Microsoft 365 / Exchange mail flow rules
* Google Workspace allowlists
* Network firewalls or secure email gateways

<Tip>
  Add these ranges to your trusted sender or inbound allowlist policies to prevent email filtering
  or blocking.
</Tip>

<Note>
  These IP ranges are maintained by our email provider and may change periodically. If your
  organization requires domain-based allowlisting instead, contact
  [support@speckle.systems](mailto:support@speckle.systems).
</Note>

## Additional resources

### Support

* **Email:** [support@speckle.systems](mailto:support@speckle.systems)
* **Community Forum:** [speckle.community](https://speckle.community)
* **SSO Setup Assistance:** We offer guided SSO configuration calls. [Contact us](mailto:support@speckle.systems) to schedule.

### Related documentation

* [Connector Installation (User Guide)](/connectors/installation)
* [Manual Connector Installation](/connectors/manual-installation/introduction)
* [SSO Configuration](/workspaces/sso)
* [Server Deployment Guide](/developers/server/getting-started) (for self-hosted deployments)

## FAQ

<AccordionGroup>
  <Accordion title="Is there a product SLA?">
    Product SLA terms depend on your plan and contract. Enterprise customers
    should refer to their commercial agreement for any uptime or availability
    commitments.
  </Accordion>

  <Accordion title="Is there a support SLA?">
    Support SLA terms depend on your plan and contract. If your organization has
    an Enterprise agreement, refer to that agreement for response-time and
    escalation commitments.
  </Accordion>

  <Accordion title="Is there a separate support SLA document?">
    SLA commitments are typically defined in your commercial agreement rather
    than a public one-size-fits-all page. Contact
    [support@speckle.systems](mailto:support@speckle.systems) if you need your
    current SLA terms confirmed.
  </Accordion>

  <Accordion title="Is the in-app support chat AI or human?">
    Both. The in-app chat is powered by Intercom FinAI for first-line responses.
    It is informed by Speckle documentation, previous support interactions, and
    public open-source repositories. Human support engineers review, follow up,
    and handle complex or escalated cases.
  </Accordion>

  <Accordion title="Do we need to allowlist domains for both connectors and the web app?">
    Yes. Connectors require access to `app.speckle.systems` for authentication
    and data transfer. The web application also requires access to the same
    domain. Allowlist `app.speckle.systems` for both use cases.
  </Accordion>

  <Accordion title="Why are connectors blocked even though ports are open?">
    Some firewalls require separate configuration to allow non-browser applications to access domains.
    Even when ports 443 and 80 are open, firewall rules may block applications like connectors that
    aren't web browsers. Configure your firewall to allow outbound HTTPS connections from all
    applications, not just browsers, or create specific rules for the connector executables.
  </Accordion>

  <Accordion title="Can we use IP addresses instead of domain names?">
    We strongly recommend using domain names. `app.speckle.systems` is served through Cloudflare,
    which uses a global CDN with dynamic IP addresses that change frequently. Domain-based rules are
    more reliable and easier to maintain. If IP-based rules are required, refer to [Cloudflare's
    published IP ranges](https://www.cloudflare.com/ips/) or contact support for assistance.
  </Accordion>

  <Accordion title="Do connectors work behind a corporate proxy?">
    Connectors support HTTP proxies configured at the system level. Ensure proxy settings allow HTTPS
    connections to `app.speckle.systems`. Authentication may require interactive browser sessions.
  </Accordion>

  <Accordion title="What if we block WebSocket connections?">
    WebSocket connections are used for real-time features in the web application. Connectors will
    function without WebSocket access, but some web app features may be limited.
  </Accordion>

  <Accordion title="Can we deploy connectors without internet access?">
    No. Connectors require internet access to authenticate users and transfer
    data. For air-gapped environments, deploy a self-hosted Speckle server
    within your network.
  </Accordion>
</AccordionGroup>