> ## Documentation Index
> Fetch the complete documentation index at: https://anam.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Network Configuration

> Allow the domains, ports, protocols, and IP ranges required for Anam sessions to connect reliably through corporate networks and firewalls.

To ensure a reliable connection to Anam, allow the endpoints, ports, and IPs below.

## Anam endpoints

| Endpoint                                                  | Purpose                                                                           |
| --------------------------------------------------------- | --------------------------------------------------------------------------------- |
| `https://api.anam.ai`                                     | REST API                                                                          |
| `https://lab.anam.ai`                                     | Anam Lab portal                                                                   |
| `https://connect.anam.ai` / `wss://connect.anam.ai`       | Global media gateway (WebRTC signaling + streaming, routed to the nearest region) |
| `https://connect-eu.anam.ai` / `wss://connect-eu.anam.ai` | EU media server (WebRTC signaling + streaming)                                    |
| `https://connect-us.anam.ai` / `wss://connect-us.anam.ai` | US media server (WebRTC signaling + streaming)                                    |

All endpoints use HTTPS and secure WebSockets on TCP port 443.

## Media connection paths

Anam streams audio and video over WebRTC. The client attempts connection paths in this order:

1. **Direct UDP (default)** — media flows over UDP port 3478 directly to Anam's media relay IPs. This is the lowest-latency path and gives the best call quality.
2. **Cloudflare TURN over TLS (automatic fallback)** — if UDP is blocked, media is relayed through Cloudflare's TURN service over TCP port 443. This works on most restrictive networks but adds some latency.

No configuration is needed for the fallback — the client switches automatically when the direct UDP path is unavailable.

### Anam media relay IPs (primary path)

Allow outbound UDP traffic to port 3478 on the following IPs:

| Region | IP addresses                     |
| ------ | -------------------------------- |
| EU     | `83.228.146.41`, `83.228.146.60` |
| US     | `166.19.90.3`, `166.19.90.23`    |

Anam aims to keep these IPs static, but they can occasionally change. If your firewall rules reference them, watch this page or the [JSON list](https://anam.ai/docs/security/ip-list.json) below for updates.

### Cloudflare TURN (fallback path)

Allow outbound traffic to `turn.cloudflare.com` on:

* TCP port 443 (TLS) — the default fallback path
* UDP and TCP port 3478 — additional relay paths that perform better on some networks

Cloudflare publishes the following addresses for firewall allowlists:

| Protocol | Addresses                                      |
| -------- | ---------------------------------------------- |
| IPv4     | `141.101.90.1/32`, `162.159.207.1/32`          |
| IPv6     | `2a06:98c1:3200::1/128`, `2606:4700:48::1/128` |

Cloudflare does not guarantee these IPs are permanent. If your firewall rules use IPs rather than the `turn.cloudflare.com` hostname, monitor its DNS records for changes.

All IPs and ports on this page are also available as JSON for automated firewall tooling: [`/docs/security/ip-list.json`](https://anam.ai/docs/security/ip-list.json).

## Force TURN relay

On networks that block direct peer-to-peer or UDP traffic, force all media through the Cloudflare TURN relay by passing a relay-only `rtcConfiguration` to `createClient`:

```typescript theme={"system"}
const anamClient = createClient(sessionToken, {
  rtcConfiguration: { iceTransportPolicy: "relay" },
});
```

See [Client Options](/docs/javascript-sdk/reference/basic-usage#client-options) for the full list of options.

## SSL inspection

If you use a proxy that performs deep-packet inspection (Zscaler, Fortinet, etc.), bypass SSL inspection for `*.anam.ai` domains and `turn.cloudflare.com`. Decrypting these packets will cause WebSocket signaling to fail or the TURN relay to disconnect.

## Content Security Policy

If your site enforces a CSP, add the following directives depending on your integration method:

```http theme={"system"}
# Widget
Content-Security-Policy: script-src https://unpkg.com/@anam-ai/; connect-src https://api.anam.ai wss://connect.anam.ai wss://connect-eu.anam.ai wss://connect-us.anam.ai;

# Player (iframe)
Content-Security-Policy: frame-src https://lab.anam.ai;

# SDK
Content-Security-Policy: connect-src https://api.anam.ai wss://connect.anam.ai wss://connect-eu.anam.ai wss://connect-us.anam.ai;
```

See the [Embed page](/docs/embed#security) for browser support and troubleshooting details.