[{"data":1,"prerenderedAt":66},["ShallowReactive",2],{"doc:\u002Fdocs\u002Fcontent-security-policy":3},{"page":4,"toc":61,"updated":65},{"path":5,"title":6,"seoTitle":7,"description":8,"blocks":9},"\u002Fdocs\u002Fcontent-security-policy","Content Security Policy","Content Security Policy for the Fingerly Browser SDK","The Content Security Policy directives the browser SDK needs: which hosts to allow, and what it never requires.",[10,13,18,33,40,42,45,52,55,57],{"type":11,"text":12},"p","If your site sends a `Content-Security-Policy` header, allow the SDK to reach Fingerly. The SDK needs very little.",{"type":14,"level":15,"text":16,"id":17},"heading",2,"Directives","directives",{"type":19,"columns":20,"rows":24},"table",[21,22,23],"Directive","Allow","Why",[25,29],[26,27,28],"`connect-src`","`https:\u002F\u002Fus.api.fingerly.io`","Identify requests and deferred reports.",[30,31,32],"`script-src`","The origin you serve `fingerly.global.js` from","Only if you use the script-tag build. A bundled import needs nothing extra.",{"type":34,"samples":35},"code",[36],{"label":37,"lang":38,"code":39},"Header","http","Content-Security-Policy: default-src 'self'; connect-src 'self' https:\u002F\u002Fus.api.fingerly.io; script-src 'self'",{"type":11,"text":41},"With a [proxy integration](\u002Fdocs\u002Fproxy-integrations) on your own origin, `connect-src 'self'` is enough.",{"type":14,"level":15,"text":43,"id":44},"What the SDK never needs","what-the-sdk-never-needs",{"type":46,"items":47},"list",[48,49,50,51],"`unsafe-eval`. The SDK does not need it; under a strict policy it simply skips what it cannot do.","`worker-src`, `wasm-unsafe-eval` or `blob:`. The SDK uses no workers and no WebAssembly.","Frames from other origins. The SDK only creates temporary same-origin frames, and keeps working without them if your policy forbids frames.","Cookies. Requests are sent without credentials, and responses set none.",{"type":14,"level":15,"text":53,"id":54},"CORS","cors",{"type":11,"text":56},"Browser requests carry the `x-api-key` header, so browsers send a preflight first. Fingerly answers it for every origin; access is then decided by your public key's allowed origins.",{"type":58,"tone":59,"text":60},"callout","note","The server API, `GET \u002Fevents`, does not answer browsers at all. Read events from your backend.",[62,63,64],{"id":17,"text":16,"level":15},{"id":44,"text":43,"level":15},{"id":54,"text":53,"level":15},"2026-09-17T08:28:36.000Z",1789667797515]