Whitelisting SuperPath for Email and App Access

In this article:

• Overview
• Why whitelisting matters
• What to whitelist
• Steps for your IT team
• Troubleshooting
• Things to keep in mind
• FAQs
• Who can do this

Overview

Some corporate networks restrict email and website traffic with firewalls, web proxies or filtering rules. To make sure SuperPath works smoothly, your IT team may need to allowlist (whitelist) a few domains and email addresses. This article lists every address SuperPath needs, grouped by what each one does.

Without them, your people may experience:

• Emails that are delayed, undelivered, or land in spam
• A sign-in page that keeps loading after they enter their email, or sign-in links that do not open
• Courses not syncing correctly across tabs or between users

Whitelisting SuperPath improves email deliverability, keeps authentication secure, and keeps the platform running seamlessly.

Why whitelisting matters

Many organisations run strict network and email security policies. This improves safety, but it can sometimes block important services. SuperPath runs in your browser and talks to several services as people use it: our own servers, a sign-in service, bot protection on the sign-in form, and a real-time service that keeps courses in sync over web sockets. If your network blocks any of these, that part of SuperPath stops working.

Whitelisting ensures that:

• Emails are delivered reliably, so sign-in links and notifications always arrive
• Authentication is secure and uninterrupted
• Real-time course sync is maintained for a smooth learning experience

What to whitelist

The simplest option is to allow *.superpath.io, which covers every SuperPath address ending in superpath.io. If your policy needs individual addresses, use the lists below. The sign-in, real-time and email addresses are not on superpath.io, so they are needed either way.

Email

• noreply@superpath.io: all SuperPath emails (sign-in links, password resets, notifications, reminders) come from this address, even when they show your platform's name as the sender. Add it to your safe senders list.
• track.pstmrk.it: our email delivery service (Postmark), which helps us monitor deliverability and security.

SuperPath platform

• app.superpath.io, app-au.superpath.io or app-eu.superpath.io: the main platform address for your data region (US, AU or EU).
• Your custom SuperPath domain, if you use one (for example learning.yourcompany.com).
• api.superpath.io, api-au.superpath.io and api-eu.superpath.io: our servers. Allow all three, whatever your region, because the sign-in page checks every region to find each person's account.
• assets.superpath.io: logos, images and uploaded files.

Sign-in

• superpath-prod.firebaseapp.com: sign-in links and password reset links in our emails open this address first, which then sends the person straight back to SuperPath. This address is the same for every data region. Opening it on its own shows a "Site Not Found" page. That is expected and does not mean anything is wrong.
• www.googleapis.com and securetoken.googleapis.com: our sign-in service (Google Firebase) uses these to sign people in and keep them signed in.
• www.recaptcha.net and www.gstatic.com: Google reCAPTCHA, which protects the sign-in form from bots.
• api.ipify.org and ipv4.icanhazip.com: look up the network address shown in sign-in security emails, so people can spot a sign-in they did not make. It is also used for the approximate location recorded against activity.

Real-time updates

Allow web socket connections to our real-time service (Pusher) for your data region, plus its fallback address:

• US: ws-us3.pusher.com and sockjs-us3.pusher.com
• AU: ws-ap4.pusher.com and sockjs-ap4.pusher.com
• EU: ws-eu.pusher.com and sockjs-eu.pusher.com

AI Course Builder

• app.mindsmith.ai: powers SuperPath's AI Course Builder (provided by our partner MindSmith); needed for authoring and playing AI-built courses.
• eu.mindsmith.ai: the AI Course Builder for accounts in the EU data region. EU accounts need this address instead of app.mindsmith.ai.

Recommended

These are not needed to sign in or learn, but pages do not look right without them:

• fonts.googleapis.com and fonts.gstatic.com: the fonts SuperPath uses.
• pro.fontawesome.com: the icons used throughout SuperPath.

Steps for your IT team

1. Add noreply@superpath.io to your organisation's safe senders or allowlist.
2. Allow *.superpath.io, or each SuperPath platform address listed above, in your firewall or proxy.
3. Allow the sign-in, real-time and AI Course Builder addresses for your data region.
4. If your proxy or data loss prevention (DLP) tool inspects web requests, allow the full request to the SuperPath API addresses, not only the host name. Some sign-in requests include the person's email address in the web address, which content filters can block.
5. Confirm that web socket connections are permitted across your network.
6. Test by signing in to SuperPath with an emailed sign-in link, then opening a course in two tabs. Updates should sync instantly.

Troubleshooting

The sign-in page keeps loading, or shows a sign-in error, after someone enters their email
Their browser cannot reach the SuperPath API. Check that api.superpath.io, api-au.superpath.io and api-eu.superpath.io are allowed, and check your proxy or DLP logs for blocked requests to those addresses. If the same person can sign in on their phone using mobile data, the block is on your network.

The sign-in link email does not arrive
Check that noreply@superpath.io is a safe sender, and look in spam or quarantine.

Clicking the sign-in link shows an error or a blank page
Check that superpath-prod.firebaseapp.com is allowed.

Your IT team sees "Site Not Found" when testing superpath-prod.firebaseapp.com
This is expected. That address only handles sign-in links, so there is nothing to show when it is opened directly. Test by signing in to SuperPath instead.

Courses do not update in real time
Check that web socket connections to the Pusher addresses for your data region are allowed.

Things to keep in mind

• You only need the platform and real-time addresses for your own data region (US, AU or EU), plus any custom SuperPath domain you use. Allow all three API addresses whatever your region.
• If you use SAML SSO, your identity provider's own domains may also need allowlisting, depending on your setup.
• If your courses embed content from other services, such as YouTube, Vimeo, Loom, Wistia, Synthesia or Genially, those services need to be allowed too.
• Once these domains and addresses are whitelisted, your team will have uninterrupted access to SuperPath, with reliable email delivery and real-time collaboration.

FAQs

Can we allow *.superpath.io instead of listing each address?
Yes. It covers the platform, API and assets addresses. You still need the email, sign-in, real-time and AI Course Builder addresses, which are not on superpath.io.

Why do we need the API addresses for regions we do not use?
The sign-in page checks every region to find which one holds each person's account. If one region's address is blocked, sign-in can be slow.

Why does superpath-prod.firebaseapp.com show "Site Not Found"?
It is a sign-in helper with nothing at its front page. Sign-in links pass through it on their way back to SuperPath, so it must be allowed, but opening it directly will always show that page.

Who can do this

Your organisation's IT or network team makes these changes, outside SuperPath. No SuperPath role is needed.

Updated on: 06/10/2026