Configure CSP for Typewise chat

If your site enforces a Content Security Policy, allow the Typewise domains below so the chat can load and connect. Merge them with your existing values.

Content-Security-Policy:
  script-src https://platform.typewise.app 'unsafe-inline';
  connect-src https://platform-api.typewise.app https://*.ably.net wss://*.ably.net https://*.ably-realtime.com wss://*.ably-realtime.com;
  style-src 'unsafe-inline';
  img-src https://platform-uploads.typewise.app data:;

Add these to connect-src only if you use the feature:

Feature	Add to `connect-src`
File attachments	`https://*.s3.eu-central-1.amazonaws.com`
Voice input	`wss://api.elevenlabs.io`

Why each value is needed

Directive	Value	Reason
`script-src`	`https://platform.typewise.app`	Hosts the widget bundle (`sdk.js`)
`script-src`	`'unsafe-inline'`	The installation snippet sets `window.twConfig` inline
`connect-src`	`https://platform-api.typewise.app`	API calls
`connect-src`	`https://.ably.net`, `wss://.ably.net`	Real-time messaging
`connect-src`	`https://.ably-realtime.com`, `wss://.ably-realtime.com`	Real-time messaging failover
`style-src`	`'unsafe-inline'`	The widget injects styles at runtime. Required
`img-src`	`https://platform-uploads.typewise.app`	Widget logo and bubble icon
`img-src`	`data:`	Inline UI icons bundled in the widget

To avoid 'unsafe-inline' in script-src, add a nonce to the inline window.twConfig script and use 'strict-dynamic':

script-src 'nonce-YOUR_NONCE' 'strict-dynamic';

This works because the installation snippet loads sdk.js from that inline script. If you load sdk.js with its own <script src> tag instead, add the nonce to that tag too. 'strict-dynamic' ignores the https://platform.typewise.app host allowance.style-src still needs 'unsafe-inline'. The widget doesn’t support style nonces.

Chat SDK

The Chat SDK renders no UI, so it only needs connect-src, plus script-src if you load the script-tag build.

Content-Security-Policy:
  script-src https://platform.typewise.app;
  connect-src https://platform-api.typewise.app https://*.ably.net wss://*.ably.net https://*.ably-realtime.com wss://*.ably-realtime.com https://*.ably.io wss://*.ably.io;

Directive	Value	Reason
`script-src`	`https://platform.typewise.app`	Script-tag build (`typewise.global.js`). Not needed if you bundle from npm
`script-src`	`https://cdn.jsdelivr.net`	Only if you load a pinned version from jsDelivr
`connect-src`	`https://platform-api.typewise.app`	API calls
`connect-src`	`.ably.net`, `.ably-realtime.com`, `*.ably.io` (`https://` and `wss://`)	Real-time messaging and failover
`connect-src`	`https://*.amazonaws.com`	File uploads, if you use `uploadFiles`
`img-src`	`https://platform-uploads.typewise.app`	Only if you render the chat logo from the configuration

Verify your CSP

Open the page with the chat

Load a page where the widget or SDK runs.

Open the browser console

Press F12 and go to the Console tab.

Look for CSP errors

They start with Refused to load or Refused to connect and name the blocked domain and directive.

Allow the blocked domain

Add it to the matching directive in your CSP header, then reload.

Troubleshooting

Symptom	Check
Widget doesn’t appear	`script-src` is missing `https://platform.typewise.app`
Messages don’t send or arrive	`connect-src` is missing `https://platform-api.typewise.app` or Ably domains
Widget unstyled or layout broken	`style-src` is missing `'unsafe-inline'`
File uploads fail	`connect-src` is missing the Amazon S3 domain
Real-time messages intermittent	`connect-src` is missing the `*.ably-realtime.com` failover domains

Migrate to Typewise

Channels

Integrations

Best practices

Chat widget

Chat SDK

Verify your CSP

Troubleshooting

​Chat widget

​Chat SDK

​Verify your CSP

​Troubleshooting

​Related

Chat widget

Chat SDK

Verify your CSP

Troubleshooting

Related