| Learn about allowing access to UserTesting domains. |
This article applies to: UserTesting
- In certain situations (most frequently when previewing a test), your corporate network can prevent you from accessing UserTesting domains. Adding our domains to an allow list (or "whitelist") can resolve this issue.
- Don't know where to enter these domains? UserTesting does not provide a platform feature to configure network allowlists. Contact your IT or Security team for assistance.
- The tables below list every domain and IP range UserTesting's platform may need to communicate with, grouped by function, along with why each is needed. All domains use HTTPS on port 443 unless noted otherwise.
- Where possible, wildcard entries (e.g.
*.usertesting.com) are used to keep the list manageable. Some corporate firewalls only match one subdomain level by default — if your team notices access issues after allowlisting a wildcard, check with your network/security team about matching multi-level subdomains (for example,auth.app.usertesting.comorut-videos-secure.global.ssl.fastly.net).
1. Core application access
Required to load and use the core UserTesting web application.
| Domain | Why it's needed |
|---|---|
*.usertesting.com |
Primary application, static assets, and related UserTesting subdomains |
cdnjs.cloudflare.com |
Standard, publicly-available JavaScript libraries used by the app |
www.gstatic.comwww.googletagmanager.com
|
Google-hosted static resources used by the web app Google Tag Manager (standard site tag management) |
2. Login & identity (security)
UserTesting uses Okta and Auth0 for secure customer login, including Single Sign-On (SSO).
| Domain | Why it's needed |
|---|---|
*.usertesting.com |
Login and authentication flows (Okta / Auth0) |
ok1static.oktacdn.com |
Static assets for Okta's login pages |
ok12static.oktacdn.com |
Static assets for Okta's login pages |
3. Video recording, playback & participant sessions
Handles recording, secure storage, and streaming playback of test sessions, plus the participant test-taking experience.
| Domain | Why it's needed |
|---|---|
*.usertesting.com |
Session recording, live streaming, legacy upload, and participant subdomains |
*.fastly.net |
Secure delivery of recorded session video (Fastly CDN) |
asset.use2.ut-assets.com |
Storage for customer-uploaded assets used in sessions |
*.s3.us-west-1.amazonaws.com |
Storage for UT Classic image-task uploads, confidentiality agreements, and prototype hosting |
*.s3.us-east-2.amazonaws.com |
Viewing recorded UTZ sessions |
4. Test content, file uploads & storage
Used when uploading test materials (documents, images, video responses) or when the platform stores and retrieves those files.
| Domain | Why it's needed |
|---|---|
*.usertesting.com |
Upload endpoint for content submitted to the platform |
social.uploadcare.com |
Social Upload feature (Google Drive, Dropbox, and other cloud storage providers) |
tlm.uploadcare.com |
Uploadcare uploader telemetry (upload events/status only; no personal data collected; can be disabled) |
*.s3.us-west-1.amazonaws.com |
Storage for dashboard video uploads |
*.s3.us-west-2.amazonaws.com |
Storage for dashboard video uploads (secondary region) |
*.s3.us-east-2.amazonaws.com |
Storage for test plan assets |
5. Analytics & product reliability monitoring
Standard telemetry services used to monitor performance/reliability and understand product usage.
| Domain | Why it's needed |
|---|---|
api.feedback.us.pendo.io |
Product feedback and in-app analytics |
browser-intake-datadoghq.com |
Application performance and error monitoring |
csp-report.browser-intake-datadoghq.com |
Content-Security-Policy violation reporting |
www.datadoghq-browser-agent.com |
Monitoring agent script delivery |
6. Real-time collaboration & communication
Powers live commenting, controlled feature rollouts, and guided onboarding content. Real-time messaging runs on PubNub's global network.
| Domain | Why it's needed |
|---|---|
*.usertesting.com |
Guided onboarding content and data subdomains |
events.launchdarkly.com |
Controlled, incremental feature rollouts (feature flagging) |
api.liveblocks.io |
Real-time collaborative commenting |
cdn.pubnub.com |
Real-time messaging library delivery (PubNub) |
usertesting.pubnubapi.com |
Real-time messaging API (PubNub) — note: this domain belongs to PubNub, not UserTesting |
*.pndsn.com |
PubNub's regional real-time delivery endpoints ("Points of Presence") worldwide |
7. Fonts & branding
Adobe Typekit domains used to render UserTesting's branded web typography.
| Domain | Why it's needed |
|---|---|
p.typekit.net |
Adobe Typekit font delivery |
use.typekit.net |
Adobe Typekit font delivery |
8. IP-range-based allowlisting
These two providers publish and rotate their own IP ranges rather than using fixed hostnames, so we recommend allowlisting directly from their documentation. If your team prefers hostname-based rules instead, the *.fastly.net wildcard above covers Fastly.
- The IPs from Fastly. Fastly is the CDN (content delivery network) UserTesting uses.
- The IPs from Okta. Okta is the identity/authorization provider UserTesting uses.
Notes for your security / network team
- AWS storage domains follow the pattern
bucket-name.s3.[region].amazonaws.com. This list wildcards the three AWS regions currently in use (us-west-1, us-west-2, and us-east-2). If your team has an older allowlist entry using the previous hyphenated format (e.g.s3-[region].amazonaws.com), please update it to the pattern above. - Some corporate proxies only match a single subdomain level. If you allowlist
*.usertesting.comor*.fastly.netand still see blocked requests, check whether multi-level subdomains (e.g.auth.app.usertesting.com,content.guide.usertesting.com,ut-videos-secure.global.ssl.fastly.net) need to be added individually alongside the wildcard.