# Content Security Policy and Network Allowlist

> Source: https://agilitycms.com/docs/developers/content-security-policy-and-network-allowlist

This page lists the Agility hosts your website, your servers and your build pipeline connect to, and the Content Security Policy (CSP) directives a site needs to load Agility assets, run inside Web Studio and load the Web Studio SDK.

> [!NOTE]
> Every host below is named in Agility's documentation or in the source of an official Agility package, and answered live DNS and HTTPS checks on 10 October 2026. Agility delivers its content APIs and assets through the Fastly CDN. Allowlist these hosts by hostname. If you need IP address information, contact Agility support.

## Hosts at a glance

| Host | Used for | Who connects | CSP directive, if the browser connects |
| --- | --- | --- | --- |
| `https://api.aglty.io` | Content Fetch API (REST), GraphQL API and Content Sync, for instances in the USA region | Your servers and build; browsers only if you call the API client-side | `connect-src` |
| `https://api-ca.aglty.io`, `https://api-eu.aglty.io`, `https://api-aus.aglty.io`, `https://api-usa2.aglty.io` | The same APIs for other data regions (see below) | As above | `connect-src` |
| `https://cdn.aglty.io` | Images and files from the media library | Browsers, and servers that process images | `img-src`, `media-src` |
| `https://mgmt.aglty.io`, `https://mgmt-ca.aglty.io`, `https://mgmt-eu.aglty.io`, `https://mgmt-aus.aglty.io`, `https://mgmt-usa2.aglty.io` | Management API, Management SDKs, the Agility CLI, and OAuth for custom apps | Servers, CI pipelines, developer machines; custom apps in the browser | `connect-src` (custom apps only) |
| `https://app.agilitycms.com` | The Agility app, which frames your site in Web Studio | Editors' browsers | `frame-ancestors` on your site |
| `https://unpkg.com` | The Web Studio SDK script and its stylesheet | Browsers, on pages that load the SDK | `script-src`, `style-src` |
| `https://mcp.agilitycms.com` | The Agility CMS MCP server for AI tools | AI clients on developer and editor machines | Not applicable |
| `https://status.agilitycms.com` | Platform status and incident notifications | People | Not applicable |

## Which API host your instance uses

The API host depends on the suffix at the end of your instance GUID. The official SDKs pick the host this way: `@agility/content-fetch` 2.0.11 for the Fetch API, and `@agility/management-sdk` 0.1.40, `@agility/cli` 1.1.0 and the [.NET Management SDK](/docs/dotNet/management-sdk-dotnet-intro) for the Management API.

| GUID ends in | Fetch and GraphQL API host | Management API host |
| --- | --- | --- |
| `-u` | `api.aglty.io` | `mgmt.aglty.io` |
| `-us2` | `api-usa2.aglty.io` | `mgmt-usa2.aglty.io` |
| `-c` | `api-ca.aglty.io` | `mgmt-ca.aglty.io` |
| `-e` | `api-eu.aglty.io` | `mgmt-eu.aglty.io` |
| `-a` | `api-aus.aglty.io` | `mgmt-aus.aglty.io` |

Two more cases:

- **A GUID with none of these suffixes.** `@agility/content-fetch` uses `https://{guid}-api.agilitycms.cloud` for the Fetch API instead, so allow that host. The Management SDKs use `mgmt.aglty.io`.
- **GraphQL** uses the same host as REST, with `/v1/` before the GUID: `POST https://api.aglty.io/v1/{guid}/{fetch|preview}/{locale}/graphql`. See [Fetch API Status Codes and Caching](/docs/developers/fetch-api-status-codes-and-caching).

## Content Security Policy for your site

Add these sources to your existing policy. They are the Agility part only: your framework, analytics and other services need their own entries.

### Agility assets

```http
Content-Security-Policy: img-src 'self' https://cdn.aglty.io; media-src 'self' https://cdn.aglty.io
```

If Agility has set up a [custom asset domain](/docs/developers/custom-asset-domains) for you, add that domain too. It works alongside the default Agility asset domain, so content can contain either.

### Calling the Fetch or GraphQL API from the browser

Most sites read content on the server and need nothing here. If your browser code calls the API directly, allow your region's host:

```http
Content-Security-Policy: connect-src 'self' https://api.aglty.io
```

In a check on 10 October 2026, the API answered cross-origin requests with `Access-Control-Allow-Origin: *` and allowed the `APIKey` header. Only call the API from the browser with a **fetch** key, and only for content you are happy to make public: a fetch key can read every published item in the instance. Never send a preview key or a Management API token to the browser (see [Hosting, Security & Compliance](/docs/owners-admins/hosting-security-and-compliance)).

### Letting Web Studio frame your site

Web Studio loads your site in a frame on `https://app.agilitycms.com`. Allow it with `frame-ancestors`, as shown in [Getting Started With Web Studio](/docs/overview/web-studio):

```http
Content-Security-Policy: frame-ancestors 'self' https://app.agilitycms.com
```

- **Replace `X-Frame-Options`.** It is deprecated in favor of `frame-ancestors`, and a `DENY` or `SAMEORIGIN` value blocks Web Studio.
- **Send it as a response header.** Browsers ignore `frame-ancestors` in a `<meta http-equiv>` tag ([MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/frame-ancestors)).
- **Cover every deployment editors open in Web Studio,** production included.

See [Set Up Web Studio with Any Framework](/docs/developers/web-studio-setup-any-framework) for framework examples, and [Troubleshooting Web Studio](/docs/developers/troubleshooting-web-studio) if the frame stays blank.

### Loading the Web Studio SDK

On pages that load the SDK (all pages, or only preview pages if you load it only in preview mode):

```http
Content-Security-Policy: script-src 'self' https://unpkg.com; style-src 'self' https://unpkg.com; img-src 'self' https://cdn.aglty.io
```

The SDK's README loads the script from `https://unpkg.com/@agility/web-studio-sdk@latest/dist/index.js`. The SDK (`@agility/web-studio-sdk` 1.0.26) adds its stylesheet from `https://unpkg.com/@agility/web-studio-sdk@latest/dist/web-studio.css` and shows an edit icon from `cdn.aglty.io`. It talks to Agility through the frame with `postMessage`, which needs no CSP entry.

Two things to know if your policy is strict:

- **Subresource integrity doesn't fit `@latest`.** The `@latest` script URL changes with each release, and the SDK loads its stylesheet from `@latest` either way. If you need a fixed, hashed script, bundle the npm package `@agility/web-studio-sdk` yourself. The stylesheet still comes from unpkg.
- **Limit it to preview** if you don't want a third-party script on public pages. Send the `unpkg.com` sources only from your preview deployment, or only on responses in preview mode.

### A complete example

A site that renders on the server, shows Agility images, runs in Web Studio and loads the SDK, with nothing else added:

```http
Content-Security-Policy:
  default-src 'self';
  img-src 'self' https://cdn.aglty.io;
  media-src 'self' https://cdn.aglty.io;
  script-src 'self' https://unpkg.com;
  style-src 'self' https://unpkg.com;
  connect-src 'self';
  frame-ancestors 'self' https://app.agilitycms.com
```

Send it as one header line. Test it with `Content-Security-Policy-Report-Only` first, and watch the browser console for blocked requests before you enforce it.

## Custom apps

A [custom app](/docs/apps/creating-apps-for-agility) runs inside the Agility app, which loads each app surface in an iframe. So:

- Don't send headers that stop your app from being framed by the Agility app, such as `X-Frame-Options` or a `frame-ancestors` directive that leaves it out.
- Its app definition at `/.well-known/agility-app.json` must be reachable cross-origin, with CORS headers set.
- If it signs in to the Management API with OAuth, it calls `https://mgmt.aglty.io/oauth/authorize` and `https://mgmt.aglty.io/oauth/token`. Allow that host in `connect-src` if the browser makes the call.

## Network allowlist for servers and pipelines

For egress rules on servers, build agents and developer machines, allow by hostname:

| Machine | Needs |
| --- | --- |
| Web servers and serverless functions that render pages | Your region's `api` host; `cdn.aglty.io` if they process images |
| Build agents for static builds | Your region's `api` host; `cdn.aglty.io` if the build downloads assets |
| CI pipelines using the CLI or Management SDKs | Your region's `mgmt` host |
| Developer machines | All of the above, plus `mcp.agilitycms.com` if they use AI tools with Agility |

This table covers the connections your own code makes. The Agility app that editors use in the browser (`app.agilitycms.com`) also loads resources from other hosts. If editors work behind a restrictive proxy, ask Agility support for the current list.

Notes:

- **A wildcard is possible but broad.** The `api`, `cdn` and `mgmt` hosts are all under `aglty.io`, so `*.aglty.io` covers them. Listing the exact hosts you need is tighter.
- **Everything is HTTPS,** with TLS 1.2 as the minimum (see [Hosting, Security & Compliance](/docs/owners-admins/hosting-security-and-compliance)).

## Inbound: webhooks

Webhooks are the one connection Agility opens to you. Agility doesn't publish a list of webhook source IP addresses, and the addresses can change, so don't rely on IP filtering ([Content Delivery & CDN Architecture](/docs/developers/content-delivery-and-cdn-architecture)). Turn on secure delivery and verify each request's signature instead. See [Verifying Signed Webhooks](/docs/developers/verifying-signed-webhooks) and [Webhook Events and Payload Reference](/docs/developers/webhook-events-and-payloads).

## Related

- [Set Up Web Studio with Any Framework](/docs/developers/web-studio-setup-any-framework)
- [Getting Started With Web Studio](/docs/overview/web-studio)
- [Content Fetch API](/docs/developers/content-fetch-api)
- [Content Delivery & CDN Architecture](/docs/developers/content-delivery-and-cdn-architecture)
- [Data Residency & Data Regions](/docs/owners-admins/data-residency-and-data-regions)
- [Hosting, Security & Compliance](/docs/owners-admins/hosting-security-and-compliance)

---

## Related pages

- [Reference Architectures](https://agilitycms.com/docs/developers/reference-architectures.md)
- [Reference Architecture: Marketing Website](https://agilitycms.com/docs/developers/reference-architecture-marketing-site.md)
- [Reference Architecture: Multi-Brand and Multi-Site](https://agilitycms.com/docs/developers/reference-architecture-multi-brand.md)
- [Reference Architecture: Headless Commerce](https://agilitycms.com/docs/developers/reference-architecture-headless-commerce.md)
- [Reference Architecture: Member Portal and Intranet](https://agilitycms.com/docs/developers/reference-architecture-member-portal.md)
- [Reference Architecture: Multi-Channel Delivery](https://agilitycms.com/docs/developers/reference-architecture-multi-channel.md)
- [Choose Your Tenancy Model](https://agilitycms.com/docs/developers/choose-your-tenancy-model.md)
- [Handle Rate Limits and Outages Gracefully](https://agilitycms.com/docs/developers/handle-rate-limits-and-outages.md)

Index of every docs page: https://agilitycms.com/docs/llms.txt