Content Security Policy

One origin to allow, in two directives. Nothing else.

If your site sends a Content-Security-Policy header, allow the Concatflow origin in script-src and frame-src:

Content-Security-Policy: script-src 'self' https://app.concatflow.com; frame-src https://app.concatflow.com

Keep your own sources in each directive. Add only https://app.concatflow.com.

Directive	Why
script-src	widget.js is served from the Concatflow origin.
frame-src	The assistant runs in an iframe on the same origin.

What Concatflow does not need:

• No 'unsafe-eval', and no inline script from widget.js.
• No connect-src. Your page never calls the Concatflow API. The iframe does, from its own origin.

If you restrict style-src

The launcher puts a <style> element in its Shadow DOM. A style-src without 'unsafe-inline' blocks it, and the bar or bubble shows unstyled. Until this changes, a policy that restricts style-src needs 'unsafe-inline' in it:

style-src 'self' 'unsafe-inline'

The assistant itself, in the iframe, is not affected: your policy does not apply inside it.

The script-tag install has an inline <script> that calls Concatflow.init. If your CSP forbids inline scripts, move that call to a file you serve, or use the npm package.

Only frame-src?

If your policy has no script-src but has default-src, the script falls under default-src. Add the origin there, or add a script-src.

Other origins

If you pass a base option to load from another Concatflow origin, allow that origin instead.

Check it

Open the browser console on your page. A CSP block reads like:

Refused to frame 'https://app.concatflow.com/' because it violates the following Content Security Policy directive: "frame-src 'self'".

With @concatflow/embed, a blocked script rejects loadConcatflow() with Concatflow: failed to load https://app.concatflow.com/widget.js.