Skip to main content
Inbound traffic reaches your app through the floo gateway. Outbound traffic leaves through floo’s standard internet egress.

​
Inbound traffic

Inbound HTTP and WebSocket requests follow this path:
  1. The request hits your floo host (*.getfloo.app, or *.on.getfloo.com for older apps) or custom domain.
  2. The floo gateway looks up the matching route.
  3. Edge policy and managed auth run before traffic reaches your container.
  4. The gateway proxies the request to the target app service.
floo hosts and custom domains are the public contract. Do not expose or depend on raw backend URLs. Inspect what the edge is serving with the route table:

​
Outbound egress

Calls to public HTTPS APIs, Slack webhooks, payment providers, and SMTP providers leave the app’s runtime through floo’s standard internet egress. If a vendor requires source-IP allowlisting, email team@getfloo.com before designing around that requirement.

​
Private network deployments

Private network deployments are not generally available yet. The planned model is an outbound-only customer-side connector:
  • The floo control plane stays public.
  • App traffic to private backends stays inside your network.
  • The connector opens an outbound tunnel to floo, so you do not need to expose inbound ports.
  • The floo gateway remains the auth, edge-policy, and audit boundary.
  • Tailnet is one possible transport, not the product model itself.
The first target is an enterprise deployment where the customer owns the private network and runs the connector near the private service. floo will publish the connector lifecycle, routing model, auth model, and failure behavior before enabling the feature for production workloads.

​
Common patterns

​
Calling Slack, Stripe, GitHub, or other HTTPS APIs

Store tokens with floo env set and read them from environment variables in your app.

​
Sending email

Prefer the email provider’s HTTPS API. For SMTP, use authenticated submission on port 587 or 465; port 25 is not a supported mail path.

​
Vendor asks for an allowlisted source IP

floo has no stable app egress IP. Prefer API-token auth, OAuth, mutual TLS, or vendor-side domain verification where the vendor supports it. If source-IP allowlisting is mandatory, contact floo before committing to that integration.