TestDino Cloud Endpoints and Domains

Complete list of internet-facing TestDino services, domains, and IP ranges used to send Playwright test results and artifacts securely.

All internet-facing TestDino services and their security configuration.

Quick Reference

Section	Description
Core Services	Dashboard, reporter/streaming, Public API
Platform Services	Backend microservice domains
Authentication & Billing	Auth endpoints, payment webhooks
Integrations	GitHub webhooks, third-party connectors
Internal Services	AI analytics, health checks, artifact storage
Network Security	CORS, TLS, rate limiting, security headers
Firewall Config	Domains to allowlist

---

Core Services

Endpoint	Description
app.testdino.com	Web application: dashboard, test results, analytics, settings
reporter.testdino.com	Reporter endpoint: receives and streams live test results via token authentication (TESTDINO_SERVER_URL)
api.testdino.com/api/v1/public	Public API v1 (read-only): PAT-authenticated access to test runs, analytics, manual tests, and project health

Platform Services

TestDino runs as microservices, each on its own domain. The app and reporter call these server-to-server. CI machines reach TestDino through app.testdino.com and reporter.testdino.com, not these hosts directly.

Domain	Service	Purpose
api.testdino.com	Public API / MCP	Read-only Public API v1 and MCP gateway
reporter.testdino.com	Reporter ingestion	Receives and streams live test results from CI
integration.testdino.com	Integration	GitHub, Jira, Linear, Slack, and other connectors
billing.testdino.com	Billing	Plans, usage, and subscription management
user.testdino.com	User	Accounts, organizations, and access tokens
tcm.testdino.com	Test Case Management	Manual test suites and cases

Authentication and Billing

Endpoint	Description
app.testdino.com/auth	Login, registration, OAuth callbacks, password reset, email verification
api.testdino.com/sso/<org-key>/callback	SSO login callback (identity-provider redirect URI)
app.testdino.com/api/v1/webhooks/razorpay	Payment webhook: receives events from Razorpay (signature-verified)

Integration Services

Endpoint	Description
app.testdino.com/api/integrations/v1/github/webhook	GitHub webhook: push events and PR updates (verified via X-Hub-Signature-256)
Integration service (internal)	Manages Jira, Linear, Asana, Slack, Monday.com connections. Not internet-facing. Accessed via the app.

Internal Services

Service	Description
Analytics service (internal)	Project analytics processing. FastAPI/Python. Not internet-facing.
api.testdino.com/health	Public API health check for monitoring and load balancer probes
Azure Blob Storage	Artifact storage: screenshots, videos, traces. Access via time-limited SAS tokens (48-hour expiry).

Network and Security

CORS

The API enforces strict CORS policies:

• Only explicitly configured origins are allowed (no wildcard *)
• Origins are defined per environment via CORS_ORIGIN configuration

TLS

• All endpoints enforce HTTPS (TLS 1.2+)
• HTTP requests redirect to HTTPS
• Certificates are managed via hosting infrastructure

Rate Limiting

Endpoint	Limit
Login	10 requests / 15 minutes
Registration	5 requests / 15 minutes
Email verification	3 requests / 60 minutes
Password reset	2 requests / 60 minutes
Global API	1,000 requests / 15 minutes

Security Headers

All responses include headers via Helmet:

• Content-Security-Policy (CSP)
• X-Frame-Options
• X-Content-Type-Options
• Strict-Transport-Security (HSTS)

Firewall Configuration

If your organization uses network-level allowlisting, add these domains:

Domain	Required For
app.testdino.com	Dashboard access
reporter.testdino.com	Reporter submission and live test-result streaming from CI
api.testdino.com	Public API v1
Azure Blob Storage domain	Artifact uploads and downloads

Related

Access to Customer Data

Full list of data TestDino collects

Data Retention

Retention periods by tier and data category