Documentation

Content Security Policy for the SDK

Configure Content Security Policy directives for the SpryUI JavaScript SDK, API requests, hosted scripts, website banners, and message assets.

What to allow

Snippettext

SpryUI core CSP requirements:
- connect-src: required for SDK token/config/events requests
- style-src: inline styles are required today
- script-src: allow https://spryui.com when loading the hosted SDK from SpryUI
- img-src: add any domains used by your message images
- font-src: only needed if your host page loads external icon/font assets

connect-src covers the SDK token, config, and event requests.
script-src needs https://spryui.com when you load the hosted SDK from SpryUI instead of your own bundle.
img-src depends on the image origins you use in message content such as {{imageUrl}}.
font-src and extra style-src domains are only needed if your host page loads third-party icon or font libraries.

SpryUI cloud API

The v1 SDK calls its compatible SpryUI cloud API automatically. Allow https://spryui.com in script-src and connect-src.

Direct cloud API examplets

import { initSpryUi } from "https://spryui.com/sdk/v1/index.mjs";

initSpryUi({
  publicKey: "YOUR_PROJECT_API_KEY",
});

CSP when connect-src must reach SpryUItext

Content-Security-Policy:
  default-src 'self';
  script-src 'self' https://spryui.com;
  connect-src 'self' https://spryui.com;
  style-src 'self' 'unsafe-inline';
  img-src 'self' data:;

Hosted SDK

Extra domains by delivery methodtext

Hosted SDK:
- script-src: add https://spryui.com
- connect-src: add https://spryui.com

Nuxt module / bundled SDK:
- script-src: allow your own app bundle origin
- connect-src: add https://spryui.com

The hosted SDK requires https://spryui.com in script-src.
Direct SpryUI API calls require https://spryui.com in connect-src.

Strict CSP notes

Snippettext

Strict CSP note:
- SpryUI injects runtime <style> blocks and inline style attributes, so style-src must allow inline styles today.
- If you paste the SDK bootstrap inline in HTML, script-src also needs a nonce/hash or 'unsafe-inline'.
- The cleanest strict-CSP setup is:
  1. host your bootstrap code in an external JS file
  2. keep script-src free of 'unsafe-inline'
  3. still allow inline styles for SpryUI-rendered messages

SpryUI does not currently require extra frame-src or worker-src allowances. Only add external img-src, font-src, or extra style-src domains when your own host page depends on those origins.