Network and firewall allowlist

If signing in, checkout or activating Granular fails on a work, school or zero-trust network (with errors like ERR_FAILED, ERR_EMPTY_RESPONSE or "Redirect is not allowed for a preflight request"), your network is blocking one of Granular's addresses. Give your IT team the list below, or do the step once on an unfiltered network such as home Wi-Fi or a phone hotspot. After that, Granular works offline day to day.

Who this is for

Anyone whose computer sits behind a company firewall, a zero-trust or secure web gateway (security software that inspects web traffic), a school network or web filtering, and who can't sign in, buy or activate Granular even though the app is installed and working.

The tell-tale sign: the same step works fine at home or on a phone hotspot, but fails on the managed computer. That points to the network, not your purchase or the app.

Symptoms you might see

• In the app: "Could not start checkout, please try again."
• On the website: "Sorry, we couldn't start checkout. Please try again in a moment."
• In a browser's developer console: POST .../checkout net::ERR_FAILED, repeated net::ERR_EMPTY_RESPONSE, or net::ERR_BLOCKED_BY_CLIENT.
• A CORS error (a browser safety check failing): "Response to preflight request doesn't pass access control check: Redirect is not allowed for a preflight request."

These are signs of a network block, not Granular errors. See why the preflight error appears.

Hosts to allowlist

Ask your IT team to allow the following addresses. Allow them by hostname, not by IP address. These services run on large networks whose IP addresses change, so an IP allowlist will break later.

Required for sign-in, purchase and activation

• api.granular.build: your Granular account sign-in, checkout, activation and receipts. This is the main address current versions use.
• granular-entitlements.omarnfarook.workers.dev: allow this too if anyone uses an older version of Granular. It is the older billing address, still running so older apps keep working.
• js.stripe.com, checkout.stripe.com, api.stripe.com: secure payment through Stripe.

Current versions use api.granular.build, which avoids a common problem: many company filters block every *.workers.dev address. Older versions use the workers.dev address above, so if you support older installs, add a specific exception for it.

Required to install and update the app

• github.com: the app download and the update feed.
• objects.githubusercontent.com: the release files the updater downloads.

Needed for publishing and sharing

• share.granular.build and *.share.granular.build: pages you publish and live links you share.

Needed for the marketplace

• granular-registry.omarnfarook.workers.dev: the marketplace catalog and downloads.
• api.github.com, raw.githubusercontent.com and codeload.github.com: Marketplace skills that come from GitHub are downloaded from there. Without them, those skills say "Couldn't reach GitHub - try again in a moment." Other resources still install.

Only if you use your own AI sign-in or keys

• api.anthropic.com: Claude.
• api.openai.com: OpenAI and Codex.
• generativelanguage.googleapis.com: Google Gemini.

If you use the AI Add-on (Granular Hosted), its traffic goes through api.granular.build (or the older workers.dev address on older versions), so no extra AI company addresses are needed.

Optional (safe to leave blocked)

• static.cloudflareinsights.com: anonymous website analytics. If an ad or tracker blocker blocks it (the ERR_BLOCKED_BY_CLIENT line), nothing breaks.

Why the "preflight redirect" error appears

Before a browser sends certain requests to another website, it sends a small "preflight" check first. Web filters often intercept a blocked request and redirect it to a block page or sign-in screen. Browsers are not allowed to follow a redirect on a preflight, so the request fails with "Redirect is not allowed for a preflight request."

In other words, that error is your network's filter answering instead of Granular. Allowing the addresses above stops the interception and the error goes away.

If you can't change the network rules

You don't have to wait for IT:

1. Connect the computer to an unfiltered network, like home Wi-Fi or your phone's hotspot.
2. Sign in, buy or activate once on that network.
3. Switch back to your normal network.

Once Pro is switched on, it is stored on your computer and checked there, so everyday use works offline. You only need Granular's addresses reachable for signing in, buying, switching Pro on for a computer, publishing, the marketplace, and the AI Add-on's hosted models. (If you use your own AI key, those requests go straight to the AI company addresses listed above.)

Using Pro on another computer

A Pro or Lifetime purchase works on up to 2 of your computers at the same time.

The easiest way:

1. On the new computer, open Settings → Account and sign in with the same email.
2. Granular offers to switch Pro on for this computer. If you're already using Pro on 2 computers, it asks which one to switch off.

If you use an unlock code instead:

1. On the new computer, open Upgrade to Pro and paste your unlock code.
2. Click Activate. If the code is already in use on your other computers, choose Move it to this computer.

Troubleshooting

It works on my other computer but not my work laptop.
That's the classic sign of a network filter. The work laptop's filter is blocking one of the addresses above. Allow it, or do the step on an unfiltered network.

I gave IT the address but it's still blocked.
Check they allowed it by hostname, not IP, and that a broader *.workers.dev block isn't overriding the exception. The Stripe addresses (js.stripe.com, checkout.stripe.com, api.stripe.com) must be allowed too, or payment won't load.

Checkout starts but payment won't load.
The Stripe addresses are being blocked. Add js.stripe.com, checkout.stripe.com and api.stripe.com.

The app won't update.
Allow github.com and objects.githubusercontent.com so the updater can check for and download new versions.

Published links won't load for people on my network.
Allow share.granular.build and *.share.granular.build.

Related