Trusted URLs

V · EThis is an official VRChat information page!

It is written and maintained by VRCWiki Team.

By default, worlds in VRChat cannot make requests to remote URLs unless the user enables the "Allow Untrusted URLs" setting. This is an intentional measure for security purposes. There is however an allowlist of trusted domains that are the exception to this rule, and are specific to the type of content being loaded. Below are the different allowlists by type.

Video Player Allowlist

The following domains are allowlisted for public video content use in video players.

Service	Domain
Akamai CDN	vod-progressive.akamaized.net
Facebook Video	*.facebook.com,*.fbcdn.net
Google Video	*.googlevideo.com
Hyperbeam	*.hyperbeam.com,*.hyperbeam.dev
Mixcloud	*.mixcloud.com
NicoNico	*.nicovideo.jp
Soundcloud	soundcloud.com,*.sndcdn.com
Topaz Chat	*.topaz.chat
Twitch.TV	*.twitch.tv,*.ttvnw.net,*.twitchcdn.net
VRCDN	*.vrcdn.live,*.vrcdn.video,*.vrcdn.cloud
Vimeo	*.vimeo.com
Youku	*.youku.com
YouTube	*.youtube.com,youtu.be

String Loading Allowlist

The following domains are allowlisted for public use with string loading using Udon.

Service	Domain
DisBridge	*.disbridge.com
GitHub	*.github.io
GitHub Gist	gist.githubusercontent.com
Pastebin	pastebin.com
VRCDN	*.vrcdn.cloud

Image Loading Allowlist

The following domains are allowlisted for public use in image loading using Udon.

Service	Domain
Discord	cdn.discordapp.com
DisBridge	*.disbridge.com
Dropbox	dl.dropbox.com,dl.dropboxusercontent.com
GitHub	*.github.io
ImageBam	images4.imagebam.com
ImgBB	i.ibb.co
imgbox	images2.imgbox.com
Imgur	i.imgur.com
Postimages	i.postimg.cc
Reddit	i.redd.it
Twitter	pbs.twimg.com
VRCDN	*.vrcdn.cloud
VRChat	assets.vrchat.com