LADLE runs entirely in the browser (web) or as a native app that talks to the same endpoints. If your firewall filters outbound traffic, these are the domains and ports to allow.
Outbound domains to allow
Protocols in use
- HTTPS / HTTP/2 for standard requests.
- Server-Sent Events (SSE) for streaming model responses — long-held connections up to several minutes per message.
- WebSocket (WSS) for real-time UI updates within the chat interface.
- None of these require any inbound ports on the client side.
Common firewall issues
- Deep packet inspection (DPI) firewalls sometimes terminate SSE connections mid-stream, causing responses to be truncated. Solution: exempt api.ladle.chat from DPI, or allow long-held SSE connections.
- Proxies that don't support HTTP/2 downgrade to HTTP/1.1 and cause slower loads. LADLE still works but noticeably slower.
- Corporate MITM certificates: LADLE uses standard TLS with public CAs. Corporate MITM proxies that rewrite the certificate should work with the standard trust store — check the proxy is not blocking WebSocket upgrades.
IPs (not recommended for allowlist)
Our services run on Vercel, Cloudflare, and Anthropic's infrastructure. All three use rotating IP ranges. Do not allowlist by IP — allowlist by domain (SNI). If your firewall doesn't support SNI-based allowlisting, contact your vendor; we can provide a static-IP tier via Business plan on request but it's not the default.
For enterprise deployment
We can complete a network questionnaire during procurement. Ask via /business/procurement. Turnaround is one business day.