> ## Documentation Index
> Fetch the complete documentation index at: https://docs.typewise.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure CSP for the chat widget

> Allow the Typewise chat widget through your Content Security Policy headers.

If your website enforces a [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP), add the following directives so the chat widget can load.

## Required directives

Merge these with your existing CSP values.

```http theme={null}
Content-Security-Policy:
  script-src https://platform.typewise.app 'unsafe-inline';
  connect-src https://platform-api.typewise.app https://*.ably.net wss://*.ably.net https://*.ably-realtime.com wss://*.ably-realtime.com;
  style-src 'unsafe-inline';
  img-src https://platform-uploads.typewise.app data:;
```

### Optional: file attachments

```http theme={null}
connect-src ... https://*.s3.eu-central-1.amazonaws.com;
```

### Optional: voice input

```http theme={null}
connect-src ... wss://api.elevenlabs.io;
```

## Directive reference

### `script-src`

| Value                           | Reason                                             |
| ------------------------------- | -------------------------------------------------- |
| `https://platform.typewise.app` | Hosts the SDK bundle (`sdk.js`)                    |
| `'unsafe-inline'`               | Installation snippet sets `window.twConfig` inline |

<Tip>
  To avoid `'unsafe-inline'` in `script-src`, add a `nonce` to the inline script and use `'strict-dynamic'`:

  ```
  script-src 'nonce-YOUR_NONCE' 'strict-dynamic';
  ```

  This does not eliminate `'unsafe-inline'` from `style-src`. The widget injects styles at runtime and does not support style nonces.
</Tip>

### `connect-src`

| Value                                                     | Reason                                |
| --------------------------------------------------------- | ------------------------------------- |
| `https://platform-api.typewise.app`                       | API calls                             |
| `https://*.ably.net` `wss://*.ably.net`                   | Real-time messaging                   |
| `https://*.ably-realtime.com` `wss://*.ably-realtime.com` | Real-time messaging failover          |
| `https://*.s3.eu-central-1.amazonaws.com`                 | File uploads (if attachments enabled) |
| `wss://api.elevenlabs.io`                                 | Voice input (if voice enabled)        |

### `style-src`

| Value             | Reason                                                                       |
| ----------------- | ---------------------------------------------------------------------------- |
| `'unsafe-inline'` | The widget injects styles at runtime. Nonces aren't supported. Not optional. |

### `img-src`

| Value                                   | Reason                             |
| --------------------------------------- | ---------------------------------- |
| `https://platform-uploads.typewise.app` | Widget logo and bubble icon        |
| `data:`                                 | Inline UI icons bundled in the SDK |

## Verify your CSP

<Steps>
  <Step title="Open your website">
    Load the page with the chat widget installed.
  </Step>

  <Step title="Open the console">
    Press **F12**, go to the **Console** tab.
  </Step>

  <Step title="Look for CSP errors">
    Errors start with `Refused to load` or `Refused to connect` and name the blocked domain and directive.
  </Step>

  <Step title="Add the blocked domain">
    Add it to the matching directive in your CSP header.
  </Step>
</Steps>

## Troubleshooting

| Symptom                          | Check                                                                     |
| -------------------------------- | ------------------------------------------------------------------------- |
| Widget doesn't appear            | `script-src` missing `https://platform.typewise.app`                      |
| Messages don't send or arrive    | `connect-src` missing `https://platform-api.typewise.app` or Ably domains |
| Widget unstyled or broken layout | `style-src` missing `'unsafe-inline'`                                     |
| File uploads fail                | `connect-src` missing `https://*.s3.eu-central-1.amazonaws.com`           |
| Real-time messages intermittent  | `connect-src` missing `*.ably-realtime.com` failover domains              |

## See also

* [Chat configuration](/documentation/behavior/chat)
* [Chat widget troubleshooting](/documentation/troubleshooting/chat-widget)
* [Embed the chat widget in a mobile app](/guides/channels/embed-chat-in-mobile-app)