> ## Documentation Index
> Fetch the complete documentation index at: https://docs.typewise.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure CSP for Typewise chat

> Allow the Typewise chat widget or Chat SDK through your Content Security Policy headers

If your site enforces a
[Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP),
allow the Typewise domains below so the chat can load and connect. Merge them
with your existing values.

## Chat widget

```http theme={null}
Content-Security-Policy:
  script-src https://platform.typewise.app 'unsafe-inline';
  connect-src https://platform-api.typewise.app https://*.ably.net wss://*.ably.net https://*.ably-realtime.com wss://*.ably-realtime.com;
  style-src 'unsafe-inline';
  img-src https://platform-uploads.typewise.app data:;
```

Add these to `connect-src` only if you use the feature:

| Feature | Add to `connect-src` |
| :- | :- |
| File attachments | `https://*.s3.eu-central-1.amazonaws.com` |
| Voice input | `wss://api.elevenlabs.io` |

> **Why each value is needed**
>
> | Directive | Value | Reason |
> | :- | :- | :- |
> | `script-src` | `https://platform.typewise.app` | Hosts the widget bundle (`sdk.js`) |
> | `script-src` | `'unsafe-inline'` | The installation snippet sets `window.twConfig` inline |
> | `connect-src` | `https://platform-api.typewise.app` | API calls |
> | `connect-src` | `https://*.ably.net`, `wss://*.ably.net` | Real-time messaging |
> | `connect-src` | `https://*.ably-realtime.com`, `wss://*.ably-realtime.com` | Real-time messaging failover |
> | `style-src` | `'unsafe-inline'` | The widget injects styles at runtime. Required |
> | `img-src` | `https://platform-uploads.typewise.app` | Widget logo and bubble icon |
> | `img-src` | `data:` | Inline UI icons bundled in the widget |

> [!TIP]
>
> To avoid `'unsafe-inline'` in `script-src`, add a nonce to the inline
> `window.twConfig` script and use `'strict-dynamic'`:
>
> ```http theme={null}
> script-src 'nonce-YOUR_NONCE' 'strict-dynamic';
> ```
>
> This works because the installation snippet loads `sdk.js` from that inline
> script. If you load `sdk.js` with its own `<script src>` tag instead, add the
> nonce to that tag too. `'strict-dynamic'` ignores the
> `https://platform.typewise.app` host allowance.
>
> `style-src` still needs `'unsafe-inline'`. The widget doesn't support style
> nonces.

## Chat SDK

The [Chat SDK](https://docs.typewise.app/guides/channels/chat-sdk/overview.md) renders no UI, so it only
needs `connect-src`, plus `script-src` if you load the script-tag build.

```http theme={null}
Content-Security-Policy:
  script-src https://platform.typewise.app;
  connect-src https://platform-api.typewise.app https://*.ably.net wss://*.ably.net https://*.ably-realtime.com wss://*.ably-realtime.com https://*.ably.io wss://*.ably.io;
```

| Directive | Value | Reason |
| :- | :- | :- |
| `script-src` | `https://platform.typewise.app` | Script-tag build (`typewise.global.js`). Not needed if you bundle from npm |
| `script-src` | `https://cdn.jsdelivr.net` | Only if you load a pinned version from jsDelivr |
| `connect-src` | `https://platform-api.typewise.app` | API calls |
| `connect-src` | `*.ably.net`, `*.ably-realtime.com`, `*.ably.io` (`https://` and `wss://`) | Real-time messaging and failover |
| `connect-src` | `https://*.amazonaws.com` | File uploads, if you use `uploadFiles` |
| `img-src` | `https://platform-uploads.typewise.app` | Only if you render the chat logo from the configuration |

## Verify your CSP

**1. Open the page with the chat**

Load a page where the widget or SDK runs.

**2. Open the browser console**

Press **F12** and go to the **Console** tab.

**3. Look for CSP errors**

They start with `Refused to load` or `Refused to connect` and name the
blocked domain and directive.

**4. Allow the blocked domain**

Add it to the matching directive in your CSP header, then reload.

## Troubleshooting

| Symptom | Check |
| :- | :- |
| Widget doesn't appear | `script-src` is missing `https://platform.typewise.app` |
| Messages don't send or arrive | `connect-src` is missing `https://platform-api.typewise.app` or Ably domains |
| Widget unstyled or layout broken | `style-src` is missing `'unsafe-inline'` |
| File uploads fail | `connect-src` is missing the Amazon S3 domain |
| Real-time messages intermittent | `connect-src` is missing the `*.ably-realtime.com` failover domains |

## Related

* [Chat widget troubleshooting](https://docs.typewise.app/documentation/troubleshooting/chat-widget.md)
* [Embed the chat widget in a mobile app](https://docs.typewise.app/guides/channels/chat-widget/mobile-app.md)
* [Chat configuration](https://docs.typewise.app/documentation/behavior/chat.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.