Layer is blocked on a company network

Last updated: October 12, 2026

Allow these domains on your firewall or proxy so Layer, its uploads, sign-in, plugins and AI assistant connection work on a company network.

Layer runs over HTTPS (port 443) only. A company network that blocks one of the domains below breaks a specific part of Layer while the rest keeps working, which is why the symptom is often "the page loads, but uploads fail" or "I can't sign in from the plugin". Find what breaks, then ask your IT team to allow the domains under it.

Everything: the app, live updates and the API

  • layer.ai: the app, the developer docs and plugin downloads. Allow WebSocket connections (wss://layer.ai) as well as HTTPS: live progress on the board, the agent chat and realtime tools run over a WebSocket.
  • app.layer.ai: older links into Layer.
  • api.app.layer.ai: the Layer API, for scripts and tools your developers build.

Without them: Layer does not load at all, or it loads but generations never show progress and new results and chat replies only appear when you reload.

Signing in

  • auth.app.layer.ai: Layer's sign-in service, for the web app, every plugin and AI assistants.
  • The provider you sign in with: Google, Microsoft, Apple, X or your company's single sign-on (Okta, Microsoft Entra ID or another identity provider). Your network usually allows these already.

Without them: the sign-in page does not open, or it opens and never returns you to Layer.

Images, videos and downloads

  • media.app.layer.ai: every image, video, 3D model and audio file you see in Layer, and every file you download.

Without it: Layer loads, but tiles on the board and in the library stay blank, previews never play, and downloads fail.

Uploads

  • uploads.app.layer.ai
  • storage.googleapis.com

Files you upload go straight from your browser, plugin or AI assistant to Layer's cloud storage, not through the page you are on. Allow both domains: the web app, the plugins, AI assistants (MCP) and the API all upload through them. Some exports, such as audit log exports, are also delivered as links on storage.googleapis.com.

Without them: every upload fails while the rest of Layer works, and the row in Transfers shows the upload failed. A proxy that inspects HTTPS traffic or limits the size of a request can also stop large uploads partway; exempt these two domains from inspection if uploads of big videos or 3D models fail and small images succeed.

AI assistants (MCP)

  • mcp.app.layer.ai: the Layer MCP server that Claude, ChatGPT, Cursor and other assistants connect to (mcp.layer.ai reaches the same server).
  • auth.app.layer.ai and layer.ai: signing in when the assistant connects.
  • uploads.app.layer.ai and storage.googleapis.com: sending your files to Layer.
  • media.app.layer.ai: the images, videos and previews the assistant shows you.

Some assistants run the upload in their own cloud sandbox rather than on your computer, for example when Claude runs code to crop an image and upload it. Then your company network is not the one that blocks it: the sandbox's own network settings apply. If the upload fails with a connection error there, allow uploads.app.layer.ai and storage.googleapis.com in the assistant's network or domain settings, or ask whoever administers the assistant for your organization. See Connect an AI assistant to Layer for setting up the connection.

Plugins

The Layer panels for Photoshop, Premiere Pro, After Effects, DaVinci Resolve and Figma, and the Blender add-on, use the same domains as the web app: layer.ai (HTTPS and WebSocket), auth.app.layer.ai, media.app.layer.ai, and the two upload domains when you send a document or selection to Layer. A plugin that opens but cannot sign in usually means auth.app.layer.ai is blocked; see You can't sign in to a Layer plugin.

Help, status and voice

  • help.layer.ai: this help center.
  • widget.usepylon.com and *.usepylon.com: the help panel and support chat inside Layer (Help & Resources).
  • status.layer.ai: Layer's status page.
  • api.cartesia.ai (HTTPS and WebSocket): talking to the agent by voice and hearing its replies read aloud.

Without them: the help panel or support chat stays empty, and voice conversations with the agent do not start. Everything else works.

Payments

  • checkout.stripe.com: buying a plan or Creative Units.
  • billing.stripe.com: managing your subscription, payment method and invoices.
  • connect.stripe.com: setting up payouts.

Stripe's pages load from further Stripe domains of their own; Stripe lists them in Domains and IP addresses. Without them: checkout or the billing portal does not open, or opens blank.

Optional

cdn.auth0.com and *.googleusercontent.com serve profile pictures. Blocking them only hides avatars. Connectors such as Google Drive and Miro reach those services' own domains, which a network that uses them already allows.

Check it from your network

  1. Open https://media.app.layer.ai and https://uploads.app.layer.ai in a browser on the company network. Any response from the server, even an error message, means the domain is reachable; a browser connection error or your company's block page means it is not.
  2. Upload a small image in Layer. If it fails while the board and library load, the upload domains are the ones blocked.
  3. Send your IT team this page and the time the upload failed, so they can find the blocked request in the proxy logs.

Still stuck?

Contact support from Help & Resources > Talk To Us in Layer. Include what fails (loading, sign-in, uploads, a plugin or an AI assistant), the exact error, whether it works on another network such as a phone hotspot, and the domain your IT team reports as blocked. Contact support with the right details lists everything that helps.

Related