Skip to main content
Add these destinations to your allowlist when a firewall, proxy, or sandbox restricts outbound traffic. You don’t need to open inbound ports. Allow only the destinations used by your integration. Apply the Live View and replay rules to each viewer’s network, not just the machine running your agent.

​
Required destinations

Allow both wildcard domains. Don’t copy a single hostname from a returned cdp_ws_url, webdriver_ws_url, or browser_live_view_url, because that hostname can change between sessions.

​
Content security policy

A network allowlist permits traffic leaving your environment. A Content Security Policy (CSP) permits content loaded by your web application. If you embed Live View or replays, configure both.

​
Live View

Merge these sources into your application’s existing CSP:

​
Replays

Merge these sources into your application’s existing frame-src directive:

​
Troubleshooting blocked connections

  • If API, SDK, or authenticated CLI requests time out, verify access to api.onkernel.com:443.
  • If kernel login doesn’t complete, verify access to auth.onkernel.com:443 and dashboard.onkernel.com:443.
  • If browser creation succeeds but CDP, WebDriver BiDi, or Live View won’t connect, verify access to both wildcard domains on port 8443.
  • If Live View loads but remains disconnected or doesn’t show video, verify access to the STUN and TURN destinations.
  • If the replay player loads but a recording doesn’t play, verify access to the replay file destination.