Configure CSP for the chat widget

If your website enforces a Content Security Policy, add the following directives so the chat widget can load.

Required directives

Merge these with your existing CSP values.

Content-Security-Policy:
  script-src https://platform.typewise.app 'unsafe-inline';
  connect-src https://platform-api.typewise.app https://*.ably.net wss://*.ably.net https://*.ably-realtime.com wss://*.ably-realtime.com;
  style-src 'unsafe-inline';
  img-src https://platform-uploads.typewise.app data:;

Optional: file attachments

connect-src ... https://*.s3.eu-central-1.amazonaws.com;

Optional: voice input

connect-src ... wss://api.elevenlabs.io;

Directive reference

`script-src`

Value	Reason
`https://platform.typewise.app`	Hosts the SDK bundle (`sdk.js`)
`'unsafe-inline'`	Installation snippet sets `window.twConfig` inline

To avoid 'unsafe-inline' in script-src, add a nonce to the inline script and use 'strict-dynamic':

script-src 'nonce-YOUR_NONCE' 'strict-dynamic';

This does not eliminate 'unsafe-inline' from style-src. The widget injects styles at runtime and does not support style nonces.

`connect-src`

Value	Reason
`https://platform-api.typewise.app`	API calls
`https://.ably.net` `wss://.ably.net`	Real-time messaging
`https://.ably-realtime.com` `wss://.ably-realtime.com`	Real-time messaging failover
`https://*.s3.eu-central-1.amazonaws.com`	File uploads (if attachments enabled)
`wss://api.elevenlabs.io`	Voice input (if voice enabled)

`style-src`

Value	Reason
`'unsafe-inline'`	The widget injects styles at runtime. Nonces aren’t supported. Not optional.

`img-src`

Value	Reason
`https://platform-uploads.typewise.app`	Widget logo and bubble icon
`data:`	Inline UI icons bundled in the SDK

Verify your CSP

Open your website

Load the page with the chat widget installed.

Open the console

Press F12, go to the Console tab.

Look for CSP errors

Errors start with Refused to load or Refused to connect and name the blocked domain and directive.

Add the blocked domain

Add it to the matching directive in your CSP header.

Troubleshooting

Symptom	Check
Widget doesn’t appear	`script-src` missing `https://platform.typewise.app`
Messages don’t send or arrive	`connect-src` missing `https://platform-api.typewise.app` or Ably domains
Widget unstyled or broken layout	`style-src` missing `'unsafe-inline'`
File uploads fail	`connect-src` missing `https://*.s3.eu-central-1.amazonaws.com`
Real-time messages intermittent	`connect-src` missing `*.ably-realtime.com` failover domains

Migrate to Typewise

Channels

Integrations

Best practices

Required directives

Optional: file attachments

Optional: voice input

Directive reference

`script-src`

`connect-src`

`style-src`

`img-src`

Verify your CSP

Troubleshooting

See also

​Required directives

​Optional: file attachments

​Optional: voice input

​Directive reference

​script-src

​connect-src

​style-src

​img-src

​Verify your CSP

​Troubleshooting

​See also

Required directives

Optional: file attachments

Optional: voice input

Directive reference

`script-src`

`connect-src`

`style-src`

`img-src`

Verify your CSP

Troubleshooting

See also