If your store has strict firewall rules, Content Security Policy (CSP) headers, or network security settings, you may need to allowlist Tolstoy's domains to ensure widgets load and function properly.
​

Tolstoy widgets may fail to load if your security settings block the domains Tolstoy uses for:
- Loading widget scripts on your page
- Rendering the video player
- Fetching video content and assets
- Sending analytics data

If you're seeing broken widgets or loading errors, allowlisting the required domains should resolve the issue.
​

For most merchants, simply allowlist these domains:

- `*.gotolstoy.com` (covers all Tolstoy services)
- `stream.mux.com` (video delivery for some content)
- `api.segment.io` (analytics)
- `d39ynn9qmq2swd.cloudfront.net` (additional assets)

To see which widget domains your installation uses:

1. Navigate to the Installation section in your Tolstoy dashboard

You can go there by clicking your profile → Settings
​

​

2. Click on the code installation option to view the embed script details, which shows the widget domain (e.g., `widget.gotolstoy.com`) that needs allowlisting

If you need granular control, here are the specific domains organized by purpose:

Widget Scripts: - `widget.gotolstoy.com` - `play.gotolstoy.com`

Player/Video Display: - `player.gotolstoy.com` - `play.gotolstoy.com`

API Connections: - `api.gotolstoy.com` - `apilb.gotolstoy.com` - `cf-apilb.gotolstoy.com`

Media & Assets: - `videos.gotolstoy.com` - `assets.gotolstoy.com` - `tolstoy-assets.gotolstoy.com` - `shopper-media.gotolstoy.com` - `stream.mux.com`

Analytics: - `analytics.gotolstoy.com` - `analytics-v2.gotolstoy.com` - `api.segment.io`

​

- Use domain allowlisting, not IP addresses — Tolstoy uses CDN services, so IP addresses can change frequently
- Shopify stores: Ensure `cdn.shopify.com` is also allowed (usually already permitted)
- Admin dashboard domains like `app.gotolstoy.com` are only needed for accessing your Tolstoy account, not for storefront widgets
- No WebSocket allowlisting required — Tolstoy doesn't use WebSocket connections on storefronts