Trusted URLs

V · EThis is an official VRChat information page!

It is reviewed and approved by the VRCWiki Team. Learn how to contribute to this page by reading the Contribution Guide.

By default, worlds in VRChat cannot make requests to untrusted URLs unless the user enables the "Allow Untrusted URLs" setting. Public instances are additionally secured by a list of up to 10 hosts, which can be set by the world creator. This is an intentional measure for security purposes. There is however an allowlist of trusted domains that are the exception to this rule, and are specific to the type of content being loaded. Below are the different allowlists by type.

Video player allowlist

The following domains are allowlisted for public video content in video players. For the complete list used at runtime, which may change at any time, query the urlList property from the config endpoint of the VRChat API.

Service	Domain
Anique Inc.	vr-static.anique.jp
Akamai CDN	vod-progressive.akamaized.net
Facebook Video	*.facebook.com,*.fbcdn.net
Furality Online Xperience	*.furality.online,live.foxcdn.io,cdn.furality.org
Gugenka Inc.	*.gugenka-media.com,*.gugenka-media.jp
Google Video	*.googlevideo.com
Hyperbeam	hyperbeam.com,hyperbeam.dev,*.hyperbeam.com,*.hyperbeam.dev
MidCircuitCDN	*.midcircuitcdn.com
Mixcloud	*.mixcloud.com
nci-system.com	*.nci-system.com
NicoNico	*.nicovideo.jp
poly.jp	*.poly.jp
sa-vrc-media.com	*.sa-vrc-media.com
Sammy Corporation (株式会社サミー)	api-vrc.sammy.co.jp,cdn-vrc.sammy.co.jp,vrc.sammy.co.jp
Soundcloud	soundcloud.com,*.sndcdn.com
The Mighty Gym	themightygym.com,mightygymcdn.nyc3.cdn.digitaloceanspaces.com
Topaz Chat	ciel.topaz.chat,topaz.chat,*.topaz.chat
Twist Events	twisteventsasia.com
Twitch	*.twitch.tv,*.ttvnw.net,*.twitchcdn.net,*.jtvnw.net,dqrpb9wgowsf5.cloudfront.net,ds0h3roq6wcgc.cloudfront.net,d2nvs31859zcd8.cloudfront.net
Unity	stream.broadcast.unity.com
URoom	*.uroom.online
VazaR	*.vazar.jp
V, inc.	*.v-inc.jp
Vimeo	*.vimeo.com
Virtual Market (VKet)	*.v-market.work,music4.cdn.vket.com,*.vket.chat,movie.vketcdn.com
Virtual Okinawa	virtualokinawa-on-demand.contents.work,*.virtualokinawa-on-demand.contents.work
VRCDN	*.vrcdn.live,*.vrcdn.video,*.vrcdn.cloud
vrtv.jp	vrc.gate.vrtv.jp,stream.vrtv.jp
VR Analog Game System CatsUdon - VRTRPGサークル「CatsUdon工房」	*.catsudon.net
VRChat	redirect.vrchat.com
XMarket	*.xr-marketplace.com
yizmarkia.com	*.yizmarkia.com
Youku	*.youku.com
YouTube	*.youtube.com,youtu.be
Unidentified Cloudflare Stream customer	customer-xv2a3pcqk85obd78.cloudflarestream.com

String loading allowlist

The following domains are allowlisted for string loading using Udon. For the complete list used at runtime, which may change at any time, query the stringHostUrlList property from the config endpoint of the VRChat API.

Service	Domain
DisBridge	*.disbridge.com
Furality Online Xperience	api.fynn.ai,api-dev.fynn.ai,boop.fynn.ai,cdn.furality.org
GitHub	*.github.io
GitHub Gist	gist.githubusercontent.com
Gugenka Inc.	*.gugenka-media.com,*.gugenka-media.jp
nci-system.com	*.nci-system.com
Pastebin	pastebin.com
poly.jp	*.poly.jp
sa-vrc-media.com	*.sa-vrc-media.com
Topaz Chat	ciel.topaz.chat
URoom	*.uroom.online
VazaR	*.vazar.jp,*.vazarapi.com
VKet	*.v-market.work,*.vket.chat
yizmarkia.com	*.yizmarkia.com
V, inc.	*.v-inc.jp
VR Analog Game System CatsUdon - VRTRPGサークル「CatsUdon工房」	*.catsudon.net
VRCDN	*.vrcdn.cloud
XMarket	*.xr-marketplace.com

Image loading allowlist

The following domains are allowlisted for image loading using Udon. For the complete list used at runtime, which may change at any time, query the imageHostUrlList property from the config endpoint of the VRChat API.

Service	Domain
Anique Inc.	vr-static.anique.jp
Discord	cdn.discordapp.com
DisBridge	*.disbridge.com
Dropbox	dl.dropbox.com,dl.dropboxusercontent.com
GitHub	*.github.io
Gugenka Inc.	*.gugenka-media.com,*.gugenka-media.jp
ImageBam	images4.imagebam.com
ImgBB	i.ibb.co
imgbox	images2.imgbox.com
Imgur	i.imgur.com
nci-system.com	*.nci-system.com
poly.jp	*.poly.jp
sa-vrc-media.com	*.sa-vrc-media.com
Postimages	i.postimg.cc
Reddit	i.redd.it
URoom	*.uroom.online
VazaR	*.vazar.jp,*.vazarapi.com
Virtual Okinawa	virtualokinawa-on-demand.contents.work,*.virtualokinawa-on-demand.contents.work
VKet	*.v-market.work,music4.cdn.vket.com
VR Analog Game System CatsUdon - VRTRPGサークル「CatsUdon工房」	*.catsudon.net
VRCDN	*.vrcdn.cloud
VRChat	assets.vrchat.com
V, inc.	*.v-inc.jp
X (formerly Twitter)	pbs.twimg.com
XMarket	*.xr-marketplace.com
yizmarkia.com	*.yizmarkia.com
YouTube	i.ytimg.com
Unidentified Cloudflare Workers customer	vrc-live-sync-api.infrastructure-517.workers.dev

See also

• Video players