For teams whose staging allows only some IP addresses, asks for a basic-auth password, shows a bot check, or is only on a VPN.

Your setup

Staging at a URL like https://staging.acme.com.
It is protected: an IP allowlist, basic auth, a WAF or bot check (Cloudflare or similar), or a private network.
Runs fail at once, or the Machine shows a block page or a timeout.

Say this to Certyn

Certyn can't open our staging. It is behind an IP allowlist. What IP do your machines use, and how do I let you in?

Checks the URL from a Machine's shell (for example with curl) to see what blocks it: a timeout, a 401 password prompt, or a 403 or challenge page from a WAF.
Tells you plainly: cloud Machines have no fixed IP address, so there is no IP to allow. Certyn's browser also has no setting to send a custom header or basic-auth credentials.
Offers the way that works: a self-hosted runner. It opens the runner form with one docker run command. Run it on a Linux host with Docker that can reach the app; it needs only outbound HTTPS. The form waits until the runner is online, then sends the default environment's runs, and the chat's Machine, to it.
Tells you what to change on your side:
- IP allowlist, WAF or bot check: allow the runner host's IP (in Cloudflare, a WAF skip rule for that IP).
- Basic auth: let that IP skip the password, for example nginx satisfy any with allow <runner IP>.
- VPN or private network: run the runner inside the network.
Checks the URL again from the runner, then does what you asked.

Runs and the chat's Machine reach your app from your network or one known IP, with no inbound firewall rule.

Cloud Machines have no fixed egress IP. Do not allowlist addresses from your logs: they can change.
Your own test scripts that Certyn runs on a Machine (Playwright, Hurl) can send a header or basic-auth credentials from a secret variable. Certyn's browser cannot.
The runner form routes only the default environment. For another one, set its Execution target to your runner in Environments.
A bot check that shows a captcha every time stops runs even from the runner. Allow the runner's IP or turn the check off on staging. See Sign-In Blocked.