CDN domains
Uploaded images, files and message attachments are served from Stream's CDN, on subdomains of stream-io-cdn.com. This page is for anyone who has to allow that traffic through something: a corporate or on-device firewall, an outbound proxy, or a Content Security Policy. It covers what to allowlist, and which rules look correct but break.
Allow HTTPS to *.stream-io-cdn.com, matched by domain suffix.
If your application sets a Content Security Policy, add *.stream-io-cdn.com to img-src and connect-src so uploaded images and attachments load.
Do not pin subdomains, paths or IP addresses
The subdomain is not stable, and it is not part of Stream's public API. Uploaded files are served from subdomains that vary with your application's region and with how Stream routes it — dublin.stream-io-cdn.com, us-east.stream-io-cdn.com and cdn.stream-io-cdn.com all appear in our own SDK examples. Which one serves your application can change without a corresponding change on your side, including during infrastructure maintenance.
Your integration never has to know which one it got. Every file URL arrives complete in the API response or event that carries the attachment, so no code path needs to construct a CDN host. Stream's own SDKs key on the domain rather than on a fixed host: the React Native SDK decides whether an image URL supports resizing by looking for .stream-io-cdn.com in the URL, not by comparing against a known subdomain.
Do not allowlist exact URLs or URL path prefixes. Signed CDN URLs carry query parameters that vary per request, image resizing adds more, and attachment and image URLs share no common path structure.
Do not allowlist by IP address. The addresses behind the CDN change continuously.
This is the opposite of the webhook guidance. Stream's webhook infrastructure sends from a fixed set of egress IP addresses that you can safely allowlist, listed under Restricting access to webhook. That list covers traffic Stream sends to you. Traffic your application sends to Stream must be allowlisted by domain.
Diagnosing a blocked request
A blocked request and a rejected request look the same from the client. A CDN request blocked by a firewall and one carrying an expired or invalid signature both return HTTP 403.
When files fail to load for users on one network and work elsewhere, check your allowlist before investigating link expiration.
Other Stream domains
Video and audio connectivity uses different domains and additional UDP and TCP port ranges, covered in Networking and firewall.