CSP Controls
Content Security Policy (CSP) controls restrict which external domains your app’s widgets can load resources from or connect to. When a widget tries to reach a domain that is not on the allowed list, the browser blocks the request.When You Need CSP Controls
You need to add a domain to your CSP allowlist when your app:- Calls a third-party API (e.g., a weather service or CRM endpoint)
- Embeds external content in an iframe (e.g., a map or video player)
- Loads images, scripts, or stylesheets from an external server
- Redirects users to an external service for authentication (e.g., OAuth)
Domain Categories
CSP domains are organized into four categories. Add each domain to the category that matches how your app uses it.Add an Allowed Domain
1
Open CSP Controls
Go to your app’s Settings > CSP Controls.
2
Add the domain to the right category
Click Add Domain under the appropriate category (Connect, Resource, Frame, or Redirect). Enter the exact domain your app needs to reach, such as
api.example.com.3
Save and retest
Click Save. Then open your app’s preview and test the tools or widgets that use the domain to confirm they work as expected.
Add one domain at a time and test after each addition. This makes it easy to identify which domain fixed a specific issue.
Common Mistake
Allowing broad domains “just in case” (e.g., adding*.example.com when you only need api.example.com) weakens your security posture and makes debugging harder. Always add the most specific domain your app actually uses.