Allow the SDK in your Content Security Policy

The Content Security Policy directives the Flamio web SDK needs, for npm installs and for the script tag.

If your site sends a Content-Security-Policy header or meta tag, it must let the SDK reach Flamio. Without that, the SDK starts but nothing reaches Flamio.

Directives to add

Directive	Add	When
`connect-src`	`https://api.flamio.org`	Always. The SDK sends sessions to this origin — the origin of your `endpoint`.
`worker-src`	`blob:`	Recommended. The SDK prepares uploads in a background worker created from a `blob:` URL.
`script-src`	`https://esm.sh`	Only when you load the SDK from esm.sh with a script tag.

Without worker-src blob:, the SDK still works: it does the same work on the main thread instead. Your console may show a CSP violation for the blocked worker.

If your policy has no worker-src, browsers use child-src, then script-src, for workers. Add blob: to the directive your policy actually uses.

Installed from npm

Your bundler includes the SDK in your own scripts. The recorder is a separate chunk of your build, served from the same place as the rest of your JavaScript, so script-src needs nothing new.

Content-Security-Policy for an npm install

Content-Security-Policy: default-src 'self'; script-src 'self'; connect-src 'self' https://api.flamio.org; worker-src 'self' blob:

Loaded with a script tag

The SDK and its recorder load from https://esm.sh. The snippet itself is an inline script, so it also needs your policy's nonce or hash, or you move it into a file on your own domain.

Content-Security-Policy for the esm.sh script tag

Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-RANDOM_NONCE' https://esm.sh; connect-src 'self' https://api.flamio.org; worker-src 'self' blob:

index.html

<script type="module" nonce="RANDOM_NONCE">
  import { Flamio } from 'https://esm.sh/@flamioai/web-sdk@0.9.0';

  Flamio.init({
    projectKey: 'YOUR_KEY_HERE',
    endpoint: 'https://api.flamio.org/api',
  });
</script>

RANDOM_NONCE — a new random value your server generates for every response and puts in both the header and the nonce attribute.
YOUR_KEY_HERE — your project's API key from Flamio On-Live > Setup.

What the SDK does not need

The SDK does not inject styles, fonts, images or frames into your page, so style-src, font-src, img-src and frame-src need no changes.

Test the policy

Send the policy as Content-Security-Policy-Report-Only first, with the Flamio origins added.
Open your site, use it for a minute and check the browser console. A line such as "Refused to connect to https://api.flamio.org" means connect-src is missing the origin.
When the console is clean, switch the header to Content-Security-Policy.