Network requirements & firewall allowlist

Who this is for

This page is for anyone whose computer sits behind a corporate firewall, a zero-trust / secure web gateway (SWG), a school network, or DNS-level content filtering — and who can’t buy or activate Granular even though the app is installed and working.

The tell-tale sign: the exact same unlock code or checkout works fine on a home network or phone hotspot, but fails on the managed machine. That points at the network, not your license or the app.

Symptoms you might see

• In the app: “Could not start checkout — please try again.”
• On the website: “Sorry — we couldn’t start checkout. Please try again in a moment.”
• In a browser console (site): POST …/checkout net::ERR_FAILED, repeated net::ERR_EMPTY_RESPONSE, or net::ERR_BLOCKED_BY_CLIENT.
• A CORS error: “Response to preflight request doesn’t pass access control check: Redirect is not allowed for a preflight request.”

These are network-block signatures, not Granular errors. See why the preflight-redirect error appears below.

Hosts to allowlist

Ask your IT team to allow the following hosts. Allowlist by hostname, not by IP address — these services are CDN-backed and their IP ranges rotate, so a fixed IP allowlist will break.

Required for purchase & license activation

• api.granular.build — checkout, license activation, and receipts. This is the primary billing host used by current Granular versions.
• granular-entitlements.omarnfarook.workers.dev — also allow this for older Granular versions. It’s the legacy billing host, still served so already-installed apps keep working.
• js.stripe.com, checkout.stripe.com, api.stripe.com — secure payment (Stripe).

Current versions use the first-party api.granular.build host, which sidesteps the category block many corporate filters apply to the entire shared *.workers.dev domain. Older installs still call granular-entitlements.omarnfarook.workers.dev, and that wholesale *.workers.dev block is the most common cause of this issue for them — so if you support older installs, allow the legacy host with an explicit exception too.

Required to install & auto-update the app

• github.com — the app download and the update feed.
• objects.githubusercontent.com — the release files the updater downloads.

Only if you use your own AI login or keys

• api.anthropic.com — Claude.
• api.openai.com — OpenAI / Codex.
• generativelanguage.googleapis.com — Google Gemini.

If you use the Granular AI add-on (hosted models, no keys to manage), its traffic also runs through the entitlement host above (api.granular.build, or the legacy granular-entitlements.omarnfarook.workers.dev on older versions), so no extra provider domains are needed for that.

Optional (safe to leave blocked)

• static.cloudflareinsights.com — anonymous page analytics. If your ad/tracker blocker blocks this (the ERR_BLOCKED_BY_CLIENT line), nothing breaks.

Why the “preflight redirect” error appears

Before a browser sends a cross-origin request, it sends a small “preflight” check first. Zero-trust and web-filtering proxies often intercept a blocked request and redirect it to an internal block page or sign-in screen. Browsers are not allowed to follow a redirect on a preflight, so the request fails with “Redirect is not allowed for a preflight request.”

In other words, that error is your network’s filter answering instead of Granular’s server. Allowlisting the hosts above stops the interception and the error goes away.

If you can’t change the network policy

You don’t have to wait on IT to get unblocked:

1. Connect the computer to an unfiltered network — home Wi-Fi or your phone’s hotspot.
2. Complete purchase and/or activation once on that network.
3. Switch back to your normal network.

Once your license is activated it is stored on the device and verified locally, so normal day-to-day use works offline. You only need the billing domain reachable for purchase, activation, moving your license to another computer, and the optional AI add-on’s hosted models. (If you bring your own AI key, those turns go directly to the provider hosts listed above.)

Moving your license to another computer

A Granular license is one device at a time, but freely moveable — you do not need to deactivate the old computer first.

1. On the new computer, open Upgrade to Pro and paste your unlock code.
2. Click Activate. If the license is already on another machine, confirm the “move it here” prompt.
3. That activates the new machine and frees the old one’s seat automatically.

The new computer must be able to reach the billing domain to activate — so if it’s on a filtered network, do the move on an unfiltered network first (see above), or ask IT to allowlist the hosts.

Troubleshooting

It works on my other Mac but not my work laptop

Classic network-filter signature. The work laptop’s zero-trust / web filter is blocking one of the hosts above (usually the *.workers.dev billing domain). Allowlist it, or activate on an unfiltered network.

I gave IT the domain but it’s still blocked

Confirm they allowed it by hostname, not IP, and that a broader *.workers.dev category block isn’t overriding the single-host exception. Stripe’s domains (js.stripe.com, checkout.stripe.com, api.stripe.com) must be allowed too, or payment won’t load.

Checkout starts but payment won’t load

That’s the Stripe hosts being blocked. Add js.stripe.com, checkout.stripe.com, and api.stripe.com.

The app won’t update

Allow github.com and objects.githubusercontent.com so the updater can read the feed and download the release.

Related