> ## Documentation Index
> Fetch the complete documentation index at: https://docs.concatflow.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Content Security Policy

> One origin to allow, in two directives. Nothing else.

If your site sends a `Content-Security-Policy` header, allow the Concatflow origin in `script-src` and `frame-src`:

```http theme={"system"}
Content-Security-Policy: script-src 'self' https://app.concatflow.com; frame-src https://app.concatflow.com
```

Keep your own sources in each directive. Add only `https://app.concatflow.com`.

| Directive | Why |
| - | - |
| `script-src` | `widget.js` is served from the Concatflow origin. |
| `frame-src` | The assistant runs in an iframe on the same origin. |

What Concatflow does not need:

* No `'unsafe-eval'`, and no inline script from `widget.js`.
* No `connect-src`. Your page never calls the Concatflow API. The iframe does, from its own origin.

## If you restrict `style-src`

The launcher puts a `<style>` element in its Shadow DOM. A `style-src` without `'unsafe-inline'` blocks it, and the bar or bubble shows unstyled. Until this changes, a policy that restricts `style-src` needs `'unsafe-inline'` in it:

```http theme={"system"}
style-src 'self' 'unsafe-inline'
```

The assistant itself, in the iframe, is not affected: your policy does not apply inside it.

> [!NOTE]
>
> The script-tag install has an inline `<script>` that calls `Concatflow.init`. If your CSP forbids inline scripts, move that call to a file you serve, or use the npm package.

## Only `frame-src`?

If your policy has no `script-src` but has `default-src`, the script falls under `default-src`. Add the origin there, or add a `script-src`.

## Other origins

If you pass a `base` option to load from another Concatflow origin, allow that origin instead.

## Check it

Open the browser console on your page. A CSP block reads like:

```text theme={"system"}
Refused to frame 'https://app.concatflow.com/' because it violates the following Content Security Policy directive: "frame-src 'self'".
```

With `@concatflow/embed`, a blocked script rejects `loadConcatflow()` with `Concatflow: failed to load https://app.concatflow.com/widget.js.`


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.