What is your developer-dependent CMS actually costing you? Calculate your costs and get a full report
What is your developer-dependent CMS actually costing you? Calculate your costs and get a full report
Architecture
Agility hosts for your CSP and firewall rules: Fetch and GraphQL API hosts per data region, the asset CDN, the Management API, Web Studio framing (frame-ancestors), the Web Studio SDK script, and webhooks.
This page lists the Agility hosts your website, your servers and your build pipeline connect to, and the Content Security Policy (CSP) directives a site needs to load Agility assets, run inside Web Studio and load the Web Studio SDK.
Every host below is named in Agility's documentation or in the source of an official Agility package, and answered live DNS and HTTPS checks on 10 October 2026. Agility delivers its content APIs and assets through the Fastly CDN. Allowlist these hosts by hostname. If you need IP address information, contact Agility support.
| Host | Used for | Who connects | CSP directive, if the browser connects |
|---|---|---|---|
https://api.aglty.io | Content Fetch API (REST), GraphQL API and Content Sync, for instances in the USA region | Your servers and build; browsers only if you call the API client-side | connect-src |
https://api-ca.aglty.io, https://api-eu.aglty.io, https://api-aus.aglty.io, https://api-usa2.aglty.io | The same APIs for other data regions (see below) | As above | connect-src |
https://cdn.aglty.io | Images and files from the media library | Browsers, and servers that process images | img-src, media-src |
https://mgmt.aglty.io, https://mgmt-ca.aglty.io, https://mgmt-eu.aglty.io, https://mgmt-aus.aglty.io, https://mgmt-usa2.aglty.io | Management API, Management SDKs, the Agility CLI, and OAuth for custom apps | Servers, CI pipelines, developer machines; custom apps in the browser | connect-src (custom apps only) |
https://app.agilitycms.com | The Agility app, which frames your site in Web Studio | Editors' browsers | frame-ancestors on your site |
https://unpkg.com | The Web Studio SDK script and its stylesheet | Browsers, on pages that load the SDK | script-src, style-src |
https://mcp.agilitycms.com | The Agility CMS MCP server for AI tools | AI clients on developer and editor machines | Not applicable |
https://status.agilitycms.com | Platform status and incident notifications | People | Not applicable |
The API host depends on the suffix at the end of your instance GUID. The official SDKs pick the host this way: @agility/content-fetch 2.0.11 for the Fetch API, and @agility/management-sdk 0.1.40, @agility/cli 1.1.0 and the .NET Management SDK for the Management API.
| GUID ends in | Fetch and GraphQL API host | Management API host |
|---|---|---|
-u | api.aglty.io | mgmt.aglty.io |
-us2 | api-usa2.aglty.io | mgmt-usa2.aglty.io |
-c | api-ca.aglty.io | mgmt-ca.aglty.io |
-e | api-eu.aglty.io | mgmt-eu.aglty.io |
-a | api-aus.aglty.io | mgmt-aus.aglty.io |
Two more cases:
@agility/content-fetch uses https://{guid}-api.agilitycms.cloud for the Fetch API instead, so allow that host. The Management SDKs use mgmt.aglty.io./v1/ before the GUID: POST https://api.aglty.io/v1/{guid}/{fetch|preview}/{locale}/graphql. See Fetch API Status Codes and Caching.Add these sources to your existing policy. They are the Agility part only: your framework, analytics and other services need their own entries.
Content-Security-Policy: img-src 'self' https://cdn.aglty.io; media-src 'self' https://cdn.aglty.io
If Agility has set up a custom asset domain for you, add that domain too. It works alongside the default Agility asset domain, so content can contain either.
Most sites read content on the server and need nothing here. If your browser code calls the API directly, allow your region's host:
Content-Security-Policy: connect-src 'self' https://api.aglty.io
In a check on 10 October 2026, the API answered cross-origin requests with Access-Control-Allow-Origin: * and allowed the APIKey header. Only call the API from the browser with a fetch key, and only for content you are happy to make public: a fetch key can read every published item in the instance. Never send a preview key or a Management API token to the browser (see Hosting, Security & Compliance).
Web Studio loads your site in a frame on https://app.agilitycms.com. Allow it with frame-ancestors, as shown in Getting Started With Web Studio:
Content-Security-Policy: frame-ancestors 'self' https://app.agilitycms.com
X-Frame-Options. It is deprecated in favor of frame-ancestors, and a DENY or SAMEORIGIN value blocks Web Studio.frame-ancestors in a <meta http-equiv> tag (MDN).See Set Up Web Studio with Any Framework for framework examples, and Troubleshooting Web Studio if the frame stays blank.
On pages that load the SDK (all pages, or only preview pages if you load it only in preview mode):
Content-Security-Policy: script-src 'self' https://unpkg.com; style-src 'self' https://unpkg.com; img-src 'self' https://cdn.aglty.io
The SDK's README loads the script from https://unpkg.com/@agility/web-studio-sdk@latest/dist/index.js. The SDK (@agility/web-studio-sdk 1.0.26) adds its stylesheet from https://unpkg.com/@agility/web-studio-sdk@latest/dist/web-studio.css and shows an edit icon from cdn.aglty.io. It talks to Agility through the frame with postMessage, which needs no CSP entry.
Two things to know if your policy is strict:
@latest. The @latest script URL changes with each release, and the SDK loads its stylesheet from @latest either way. If you need a fixed, hashed script, bundle the npm package @agility/web-studio-sdk yourself. The stylesheet still comes from unpkg.unpkg.com sources only from your preview deployment, or only on responses in preview mode.A site that renders on the server, shows Agility images, runs in Web Studio and loads the SDK, with nothing else added:
Content-Security-Policy:
default-src 'self';
img-src 'self' https://cdn.aglty.io;
media-src 'self' https://cdn.aglty.io;
script-src 'self' https://unpkg.com;
style-src 'self' https://unpkg.com;
connect-src 'self';
frame-ancestors 'self' https://app.agilitycms.com
Send it as one header line. Test it with Content-Security-Policy-Report-Only first, and watch the browser console for blocked requests before you enforce it.
A custom app runs inside the Agility app, which loads each app surface in an iframe. So:
X-Frame-Options or a frame-ancestors directive that leaves it out./.well-known/agility-app.json must be reachable cross-origin, with CORS headers set.https://mgmt.aglty.io/oauth/authorize and https://mgmt.aglty.io/oauth/token. Allow that host in connect-src if the browser makes the call.For egress rules on servers, build agents and developer machines, allow by hostname:
| Machine | Needs |
|---|---|
| Web servers and serverless functions that render pages | Your region's api host; cdn.aglty.io if they process images |
| Build agents for static builds | Your region's api host; cdn.aglty.io if the build downloads assets |
| CI pipelines using the CLI or Management SDKs | Your region's mgmt host |
| Developer machines | All of the above, plus mcp.agilitycms.com if they use AI tools with Agility |
This table covers the connections your own code makes. The Agility app that editors use in the browser (app.agilitycms.com) also loads resources from other hosts. If editors work behind a restrictive proxy, ask Agility support for the current list.
Notes:
api, cdn and mgmt hosts are all under aglty.io, so *.aglty.io covers them. Listing the exact hosts you need is tighter.Webhooks are the one connection Agility opens to you. Agility doesn't publish a list of webhook source IP addresses, and the addresses can change, so don't rely on IP filtering (Content Delivery & CDN Architecture). Turn on secure delivery and verify each request's signature instead. See Verifying Signed Webhooks and Webhook Events and Payload Reference.