Trusted URLs
By default, worlds in VRChat cannot make requests to untrusted URLs unless the user enables the "Allow Untrusted URLs" setting. Public instances are additionally secured by a list of up to 10 hosts, which can be set by the world creator. This is an intentional measure for security purposes. There is however an allowlist of trusted domains that are the exception to this rule, and are specific to the type of content being loaded. Below are the different allowlists by type.
Video player allowlist
The following domains are allowlisted for public video content in video players. For the complete list used at runtime, which may change at any time, query the urlList property from the config endpoint of the VRChat API.
| Service | Domain |
|---|---|
| Anique Inc. | vr-static.anique.jp
|
| Akamai CDN | vod-progressive.akamaized.net
|
| Facebook Video | *.facebook.com,*.fbcdn.net
|
| Furality Online Xperience | *.furality.online,live.foxcdn.io,cdn.furality.org
|
| Gugenka Inc. | *.gugenka-media.com,*.gugenka-media.jp
|
| Google Video | *.googlevideo.com
|
| Hyperbeam | hyperbeam.com,hyperbeam.dev,*.hyperbeam.com,*.hyperbeam.dev
|
| MidCircuitCDN | *.midcircuitcdn.com
|
| Mixcloud | *.mixcloud.com
|
| nci-system.com | *.nci-system.com
|
| NicoNico | *.nicovideo.jp
|
| poly.jp | *.poly.jp
|
| sa-vrc-media.com | *.sa-vrc-media.com
|
| Sammy Corporation (株式会社サミー) | api-vrc.sammy.co.jp,cdn-vrc.sammy.co.jp,vrc.sammy.co.jp
|
| Soundcloud | soundcloud.com,*.sndcdn.com
|
| The Mighty Gym | themightygym.com,mightygymcdn.nyc3.cdn.digitaloceanspaces.com
|
| Topaz Chat | ciel.topaz.chat,topaz.chat,*.topaz.chat
|
| Twist Events | twisteventsasia.com
|
| Twitch | *.twitch.tv,*.ttvnw.net,*.twitchcdn.net,*.jtvnw.net,dqrpb9wgowsf5.cloudfront.net,ds0h3roq6wcgc.cloudfront.net,d2nvs31859zcd8.cloudfront.net
|
| Unity | stream.broadcast.unity.com
|
| URoom | *.uroom.online
|
| VazaR | *.vazar.jp
|
| V, inc. | *.v-inc.jp
|
| Vimeo | *.vimeo.com
|
| Virtual Market (VKet) | *.v-market.work,music4.cdn.vket.com,*.vket.chat,movie.vketcdn.com
|
| Virtual Okinawa | virtualokinawa-on-demand.contents.work,*.virtualokinawa-on-demand.contents.work
|
| VRCDN | *.vrcdn.live,*.vrcdn.video,*.vrcdn.cloud
|
| vrtv.jp | vrc.gate.vrtv.jp,stream.vrtv.jp
|
| VR Analog Game System CatsUdon - VRTRPGサークル「CatsUdon工房」 | *.catsudon.net
|
| VRChat | redirect.vrchat.com
|
| XMarket | *.xr-marketplace.com
|
| yizmarkia.com | *.yizmarkia.com
|
| Youku | *.youku.com
|
| YouTube | *.youtube.com,youtu.be
|
| Unidentified Cloudflare Stream customer | customer-xv2a3pcqk85obd78.cloudflarestream.com
|
String loading allowlist
The following domains are allowlisted for string loading using Udon. For the complete list used at runtime, which may change at any time, query the stringHostUrlList property from the config endpoint of the VRChat API.
| Service | Domain |
|---|---|
| DisBridge | *.disbridge.com
|
| Furality Online Xperience | api.fynn.ai,api-dev.fynn.ai,boop.fynn.ai,cdn.furality.org
|
| GitHub | *.github.io
|
| GitHub Gist | gist.githubusercontent.com
|
| Gugenka Inc. | *.gugenka-media.com,*.gugenka-media.jp
|
| nci-system.com | *.nci-system.com
|
| Pastebin | pastebin.com
|
| poly.jp | *.poly.jp
|
| sa-vrc-media.com | *.sa-vrc-media.com
|
| Topaz Chat | ciel.topaz.chat
|
| URoom | *.uroom.online
|
| VazaR | *.vazar.jp,*.vazarapi.com
|
| VKet | *.v-market.work,*.vket.chat
|
| yizmarkia.com | *.yizmarkia.com
|
| V, inc. | *.v-inc.jp
|
| VR Analog Game System CatsUdon - VRTRPGサークル「CatsUdon工房」 | *.catsudon.net
|
| VRCDN | *.vrcdn.cloud
|
| XMarket | *.xr-marketplace.com
|
Image loading allowlist
The following domains are allowlisted for image loading using Udon. For the complete list used at runtime, which may change at any time, query the imageHostUrlList property from the config endpoint of the VRChat API.
| Service | Domain |
|---|---|
| Anique Inc. | vr-static.anique.jp
|
| Discord | cdn.discordapp.com
|
| DisBridge | *.disbridge.com
|
| Dropbox | dl.dropbox.com,dl.dropboxusercontent.com
|
| GitHub | *.github.io
|
| Gugenka Inc. | *.gugenka-media.com,*.gugenka-media.jp
|
| ImageBam | images4.imagebam.com
|
| ImgBB | i.ibb.co
|
| imgbox | images2.imgbox.com
|
| Imgur | i.imgur.com
|
| nci-system.com | *.nci-system.com
|
| poly.jp | *.poly.jp
|
| sa-vrc-media.com | *.sa-vrc-media.com
|
| Postimages | i.postimg.cc
|
i.redd.it
| |
| URoom | *.uroom.online
|
| VazaR | *.vazar.jp,*.vazarapi.com
|
| Virtual Okinawa | virtualokinawa-on-demand.contents.work,*.virtualokinawa-on-demand.contents.work
|
| VKet | *.v-market.work,music4.cdn.vket.com
|
| VR Analog Game System CatsUdon - VRTRPGサークル「CatsUdon工房」 | *.catsudon.net
|
| VRCDN | *.vrcdn.cloud
|
| VRChat | assets.vrchat.com
|
| V, inc. | *.v-inc.jp
|
| X (formerly Twitter) | pbs.twimg.com
|
| XMarket | *.xr-marketplace.com
|
| yizmarkia.com | *.yizmarkia.com
|
| YouTube | i.ytimg.com
|
| Unidentified Cloudflare Workers customer | vrc-live-sync-api.infrastructure-517.workers.dev
|
