Skip to main content
If your site sends a Content-Security-Policy header, allow the Concatflow origin in script-src and frame-src:
Keep your own sources in each directive. Add only https://app.concatflow.com. What Concatflow does not need:
  • No 'unsafe-eval', and no inline script from widget.js.
  • No connect-src. Your page never calls the Concatflow API. The iframe does, from its own origin.

​
If you restrict style-src

The launcher puts a <style> element in its Shadow DOM. A style-src without 'unsafe-inline' blocks it, and the bar or bubble shows unstyled. Until this changes, a policy that restricts style-src needs 'unsafe-inline' in it:
The assistant itself, in the iframe, is not affected: your policy does not apply inside it.
The script-tag install has an inline <script> that calls Concatflow.init. If your CSP forbids inline scripts, move that call to a file you serve, or use the npm package.

​
Only frame-src?

If your policy has no script-src but has default-src, the script falls under default-src. Add the origin there, or add a script-src.

​
Other origins

If you pass a base option to load from another Concatflow origin, allow that origin instead.

​
Check it

Open the browser console on your page. A CSP block reads like:
With @concatflow/embed, a blocked script rejects loadConcatflow() with Concatflow: failed to load https://app.concatflow.com/widget.js.