Skip to content
Grona Developers

Domains and network calls

Grona uses two production hosts: cdn.grona.ai for files and api.grona.ai for everything that sends or returns data. This page lists every path family on each host, what it is for and who calls it, so you can configure firewalls, proxies and a Content Security Policy, and answer a security review.

Production hosts

Section titled “Production hosts”
Host Path Purpose Called by
cdn.grona.ai /workspaces/YOUR_WORKSPACE_ID/antiflicker.js The anti-flicker script Visitors’ browsers
cdn.grona.ai /workspaces/YOUR_WORKSPACE_ID/main.js The runtime script, with your active campaigns Visitors’ browsers
cdn.grona.ai /workspaces/YOUR_WORKSPACE_ID/campaigns/... Variation changes files, fetched once when a visitor is enrolled, and the images and assets variations use Visitors’ browsers
api.grona.ai /track/... Event batches and anti-flicker timing reports Visitors’ browsers
api.grona.ai /preview/... The variation to show when a page is opened with a preview link Browsers opening a preview link
api.grona.ai /v1/... The Public API Your backend
api.grona.ai /v1/editor/launch The target of editor links, which opens the visual editor Your team’s browsers
api.grona.ai /v1/mobile/... The signed app configuration, event batches and preview pairing Your apps

Every call uses HTTPS. The script, the SDKs and the Public API contact no other Grona hosts, and there are no test or sandbox hosts to allow.

Other origins

Section titled “Other origins”
  • Content inside a variation. A variation can insert a block that loads images, fonts or scripts from another origin, such as an embedded video. Those origins depend on the variation, so check the variation before you go live.
  • Images in apps. SDK components load images only over HTTPS from the hosts listed in your workspace’s signed configuration, or from images bundled in the app. Ask Grona which hosts your workspace uses.

Allowlist for firewalls and proxies

Section titled “Allowlist for firewalls and proxies”
Surface Allow outbound HTTPS to
Website visitors cdn.grona.ai and api.grona.ai
Your backend, for the Public API api.grona.ai
Your apps api.grona.ai, plus the image hosts in your configuration

The SDK sends If-None-Match when it refreshes the configuration and reads the ETag and Retry-After response headers. Let these headers through unchanged.

Content Security Policy

Section titled “Content Security Policy”

If your site sends a Content-Security-Policy header, it must allow both hosts: cdn.grona.ai in script-src, connect-src and img-src, and api.grona.ai in connect-src. It also needs 'unsafe-inline' in style-src, for the anti-flicker style and the styles variations add. Content Security Policy lists every directive, with a policy you can copy.

When a host is blocked

Section titled “When a host is blocked”

For what website visitors see when a firewall, proxy or ad blocker blocks cdn.grona.ai, main.js or api.grona.ai, see Performance. If an app cannot reach its config URL, the SDK keeps using the last good configuration, or the bundled one, until it expires.

Requests from Grona to your site

Section titled “Requests from Grona to your site”

Grona’s servers also request your pages, from outside your network:

  • The visual editor and the dashboard’s preview. Grona fetches the page with a desktop Chrome browser’s headers, follows up to five redirects, and serves its copy into the dashboard. When the page is an empty client-rendered shell, or bot protection blocks the request, Grona renders it in a headless browser instead. See Visual editor requirements.
  • The installation check. The dashboard check loads the page you enter in headless Chromium with a fixed desktop Chrome user agent, currently Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36. See Verify your installation.

Preview links that you or your team open run in your own browsers, so they are not requests from Grona.

Grona does not publish IP ranges for these requests, so you cannot admit them with an IP allow list. A firewall that admits only your own network blocks both the editor and the installation check.

Next steps

Section titled “Next steps”