For IT teams: what SaRA and its browser extension need from your network and your browsers.
SaRA runs in the browser. Clinicians also use Bridge, a Chrome and Edge extension built by our partner Arrow Health, which shows SaRA in a panel next to your EMR. This page lists every address both need, the ports, the browser settings, and what a block looks like to your staff.
Short version: allow the addresses below over HTTPS on port 443, including secure websocket connections (wss). Nothing needs an inbound port. Let your managed browsers install extension ID fieamabnfgcgmcpmfgcjbgcfkibgfpfg.
SaRA
Address | Used for |
| The SaRA app. It is also the page shown inside the Bridge panel. |
| Everything the app loads and saves, over HTTPS and secure websockets (wss). |
| This Help Center. |
If your firewall takes wildcards, *.sarahealth.com over HTTPS and wss covers all three.
Services the SaRA app loads
Service | Addresses | Used for |
Intercom |
| The in-app chat with our team and this Help Center |
Sendbird |
| Messages between your team and patients |
LaunchDarkly |
| Turning features on for your practice |
Sentry |
| Error reports that help us fix problems |
Segment |
| Product usage measurement |
Stripe |
| Adding a payment method and paying invoices |
Font Awesome |
| Icons |
Google Cloud Storage |
| Photos and files sent in messages |
HubSpot |
| The agreement page shown during onboarding |
Images in the app can come from other secure (HTTPS) addresses, so we suggest not filtering images by address.
The Bridge extension
Address | Used for | Status |
| The Bridge listing in the Chrome Web Store | Confirmed |
| Downloading Bridge and its automatic updates (Google's published extension hosts) | Confirmed |
| Bridge sign-in for embedded apps such as SaRA | Confirmed |
Email from | The one-time code staff receive the first time they sign in. Allow it in your email filtering. | Confirmed |
| Sign-in, the app list, support requests and the version check | Confirmed by Arrow |
| Product usage events | Confirmed by Arrow |
| Download of the extension package (Chrome's download network) | Confirmed by Arrow |
Arrow Health confirmed this list on October 5, 2026: the three bridge.arrowhealth.io addresses plus clients2.google.com, clients2.googleusercontent.com and *.gvt1.com are everything Bridge itself needs. If your firewall takes wildcards, *.bridge.arrowhealth.io covers the first three.
Your EMR's own web address also has to stay reachable, since Bridge runs on top of it.
Ports
TCP 443 outbound, for HTTPS and for secure websockets (wss). SaRA keeps a live websocket open for messages and updates.
No inbound ports, and nothing to install on a server.
Browsers
Google Chrome or Microsoft Edge, on automatic updates. Arrow publishes version 115 as the oldest Bridge runs on, and supports the newest three versions best. An out of date browser can switch extensions off.
Each person uses Bridge in the browser and the browser profile where it is installed.
Managed Chrome and Edge
Allow the extension ID
fieamabnfgcgmcpmfgcjbgcfkibgfpfg. If you block extensions by default, add it to your allow list.To push Bridge to every computer, force-install the same ID with the Chrome Web Store update address
https://clients2.google.com/service/update2/crx. Google's guide is Configure ExtensionSettings policy.Let Bridge run on your EMR's web address. A policy that limits where extensions may run, or locks Site access, stops the panel from appearing.
After a push, each person still confirms their email once in the Bridge panel. Arrow's notes for IT installs are on its IT push page.
What a block looks like
Your staff will not see an error that names your firewall. They see one of these:
The SaRA icon in the Bridge toolbar stays grey, or the panel never connects, for everyone at a site.
The panel says Connection failed. Please refresh and try again.
The one-time code email never arrives.
Messages or the chat bubble do not load in SaRA.
On one practice's first live day, the panel would not connect at any of their clinics. Their firewall was blocking the extension's traffic. It worked as soon as their security team allowed the addresses on this page. That is why we ask for this list before go-live.
How to check it works
From a clinic computer, open app.sarahealth.com and sign in. The chat bubble appears in the bottom corner.
Install Bridge and log in to your EMR. Confirm your email in the Bridge panel. The SaRA icon turns from grey to colour.
Click the SaRA icon. SaRA opens next to the chart.
What to send us
Every email ending (the part after the @) your staff sign in with, so we can register each one for your practice.
If your staff open athenaOne through single sign-on with Microsoft Entra ID: your tenant ID, the Application (client) ID of your athenaOne enterprise app, and your Athena SSO provider ID. Bridge needs these registered before your staff sign in.
A name and email for the person on your IT team we should contact.
Send them through the chat bubble in SaRA, or see How to reach SaRA support. The clinician side of setup is in The SaRA browser extension and Signing in through the extension for the first time.