Network Requirements

Overview

TinaCloud's authentication and content services communicate with several external domains. If your network uses a firewall, VPN, or proxy that restricts outbound traffic, you will need to whitelist the domains listed below to ensure TinaCMS functions correctly.

Required Domains

TinaCloud Services

Domain	Purpose
`*.tina.io`	TinaCloud dashboard and asset delivery
`identity.tinajs.io`	Authentication and identity services (v1)
`identity-v2.tinajs.io`	Authentication and identity services (v2). Required alongside `identity.tinajs.io` during the v1→v2 rollout.
`content.tinajs.io`	Content API and data layer
`assets.tinajs.io`	Asset management and delivery

Authentication (OAuth / SSO)

TinaCloud uses AWS Cognito and API Gateway for authentication. The login flow redirects through these domains during sign-in:

Domain	Purpose
`*.auth.us-east-1.amazoncognito.com`	AWS Cognito hosted UI (OAuth authorization)
`cognito-idp.us-east-1.amazonaws.com`	AWS Cognito Identity Provider API
`*.execute-api.us-east-1.amazonaws.com`	AWS API Gateway (OIDC identity bridge)

Media Uploads (S3)

When you upload media through the TinaCMS media manager, the dashboard receives a presigned URL from the assets API and PUTs the file directly to S3. The browser must be able to reach S3 for any media upload to succeed:

Domain	Purpose
`s3.us-east-1.amazonaws.com`	Direct file uploads to TinaCloud's media bucket via presigned URL

GitHub

If your project uses GitHub as its git provider (the default for TinaCloud):

Domain	Purpose
`github.com`	GitHub OAuth authorization and repository access
`api.github.com`	GitHub API for token exchange and user info

Product Analytics (PostHog)

The TinaCMS admin UI emits product-analytics events via PostHog to help us improve the editor. On strict networks or CSPs you'll need to allow:

Domain	Purpose
`us.i.posthog.com`	PostHog event ingestion
`us-assets.i.posthog.com`	PostHog runtime assets (autocapture, session recording, feature flags) — loaded lazily by `posthog-js`

Enterprise SSO (WorkOS)

If your organization uses enterprise SSO through TinaCloud:

Domain	Purpose
`*.workos.com`	WorkOS enterprise SSO provider

TinaCloud's Own IP Addresses

TinaCloud runs on AWS Lambda. Our services send their requests from the shared AWS address pool, and the address changes. We cannot give you an IP address or a CIDR range to add to an allow list.

Troubleshooting

If you see a "Login attempt timed out" error when authenticating from a VPN or restricted network, it is likely that one of the authentication domains listed above is being blocked. The sign-in flow must complete a full redirect chain within 20 seconds, and any blocked domain in that chain will cause a timeout.