Ask for an attachment as a download and the hub hands Claude a link. Claude
then has to go and fetch it, and it will not fetch from an address it has not
been told it may use.
That permission is a setting in your own Claude account, not in your hub. This
page is the one setting, and it is a one-off.
This only matters for downloads. Asking what an attachment says needs
nothing on this page: the text comes back through the hub itself.
What you will see if it is not set
The link arrives and looks fine. The download then fails, and the failure says
nothing useful about why, because from Claude’s side there is nothing to say:
it was simply not allowed to go there.
If a download link is handed to you and fetching it comes back empty or
refused, this setting is the first thing to check.
Where the setting is
In Claude, open Settings, then Capabilities, then Code execution and
file creation.
Allow network egress must be on. Under it there is a Domain allowlist.
Two ways to do it
Either works. The first is narrower.
Allow the one address
Leave the allowlist on Package managers only and add
storage.googleapis.com under Additional allowed domains.
That is where the files are served from. Nothing else is opened up.
Allow everything
Or set the allowlist to All domains.
Simpler, and it also covers anything else you later ask Claude to fetch. It is
the wider of the two, so it is worth choosing on purpose rather than because it
was fewer clicks.
On a Team or Enterprise plan, network access is off to begin with and only an
owner can turn it on, in the organisation’s settings. If the section above is
missing or greyed out, that is why.
Then ask again
Nothing has to be restarted and the hub is not involved. Ask for the
attachment again and the download works.
What a download costs you
The file is put in a storage bucket in your own Google Cloud project for the
fifteen minutes the link lasts, then deleted. Storage that brief rounds to
nothing; what is billed is the traffic of the download itself, and it is
measured in fractions of a cent per file. See What it costs.
The link is signed, so it cannot be guessed, and it stops working when it
expires.
If your hub does not offer downloads at all
Downloads need a storage bucket set up for your hub. Without one, asking for a
download link says so rather than failing, and Self-diagnosis on the admin
screen shows which it is. Reading attachments is unaffected either way and
needs no bucket.
See the release notes for what arrived when. 
