Skip to main content
To ensure a reliable connection to Anam, allow the endpoints, ports, and IPs below.

​
Anam endpoints

All endpoints use HTTPS and secure WebSockets on TCP port 443.

​
Media connection paths

Anam streams audio and video over WebRTC. The client attempts connection paths in this order:
  1. Direct UDP (default) — media flows over UDP port 3478 directly to Anam’s media relay IPs. This is the lowest-latency path and gives the best call quality.
  2. Cloudflare TURN over TLS (automatic fallback) — if UDP is blocked, media is relayed through Cloudflare’s TURN service over TCP port 443. This works on most restrictive networks but adds some latency.
No configuration is needed for the fallback — the client switches automatically when the direct UDP path is unavailable.

​
Anam media relay IPs (primary path)

Allow outbound UDP traffic to port 3478 on the following IPs: Anam aims to keep these IPs static, but they can occasionally change. If your firewall rules reference them, watch this page or the JSON list below for updates.

​
Cloudflare TURN (fallback path)

Allow outbound traffic to turn.cloudflare.com on:
  • TCP port 443 (TLS) — the default fallback path
  • UDP and TCP port 3478 — additional relay paths that perform better on some networks
Cloudflare publishes the following addresses for firewall allowlists: Cloudflare does not guarantee these IPs are permanent. If your firewall rules use IPs rather than the turn.cloudflare.com hostname, monitor its DNS records for changes. All IPs and ports on this page are also available as JSON for automated firewall tooling: /docs/security/ip-list.json.

​
Force TURN relay

On networks that block direct peer-to-peer or UDP traffic, force all media through the Cloudflare TURN relay by passing a relay-only rtcConfiguration to createClient:
See Client Options for the full list of options.

​
SSL inspection

If you use a proxy that performs deep-packet inspection (Zscaler, Fortinet, etc.), bypass SSL inspection for *.anam.ai domains and turn.cloudflare.com. Decrypting these packets will cause WebSocket signaling to fail or the TURN relay to disconnect.

​
Content Security Policy

If your site enforces a CSP, add the following directives depending on your integration method:
See the Embed page for browser support and troubleshooting details.
Last modified on July 28, 2026