Velaro Chat (our live chat widget) and Velaro Messaging (our messaging widget) load scripts and open connections to several Velaro hosts. If your website sends a Content Security Policy (CSP), it must allow those hosts or the widget will not load, or chat will open but messages will not arrive. This article lists what to allow. Last reviewed: October 17, 2026.

Which Option Should I Use?

The options below cover both platforms, so the policy keeps working if your account later moves from one Velaro platform to the other. Use the policy that fits how you manage your site.

• Option 1, wildcard (recommended): one short policy. Velaro adds or changes hosts under velaro.com from time to time for redundancy and new services, and this policy keeps working without any change on your side.
• Option 2, explicit list: every host named individually. This is the narrowest policy, but you must update it yourself whenever a host is added or changed.
• Option 3, wildcard plus the two Azure hosts (the simplest policy for an existing Velaro Chat install): if your widget code was installed some time ago, this is all it needs. It adds only the velaro.com wildcard and the two Azure addresses your install still loads from.

Option 1: Wildcard (Recommended)

Copy and paste these entries into your existing CSP. If you already have a directive (for example connect-src), add the values to it instead of creating a second one.

Content-Security-Policy:
script-src  'self' https://*.velaro.com https://eastprodcdn.azureedge.net;
connect-src 'self' https://*.velaro.com wss://*.velaro.com https://*.service.signalr.net wss://*.service.signalr.net;
frame-src   'self' https://*.velaro.com https://eastprodcdn.azureedge.net;
img-src     'self' data: https://*.velaro.com https://eastprodcdn.azureedge.net https://galleryuseastprod.blob.core.windows.net https://velaromessagingprod.blob.core.windows.net;
media-src   'self' https://*.velaro.com https://galleryuseastprod.blob.core.windows.net https://velaromessagingprod.blob.core.windows.net;
style-src   'self' 'unsafe-inline';

Everything on velaro.com is covered by the first entry in each line. The remaining entries are hosts that are not under velaro.com (see "Hosts Not Under velaro.com" below). You can leave out the ones that do not apply to you:

If you do not use	You can leave out
Velaro Chat	eastprodcdn.azureedge.net and galleryuseastprod.blob.core.windows.net
Velaro Messaging	velaromessagingprod.blob.core.windows.net
Chat images, files or sounds	The blob.core.windows.net entries in img-src and media-src

We recommend keeping all of the entries, even for a platform or feature you do not use today. A listed host does not mean it is in use right now. We may serve a service from one of these hosts, for example during maintenance, scaling or a migration, and an entry you removed would then block it.

About the Wildcard and Security

https://*.velaro.com allows your pages to load from, and connect to, every current and future subdomain of velaro.com, including ones the widget does not use. That is a wider trust surface than an explicit list. If one of those subdomains were ever misconfigured or taken over, your policy would still allow it. It does not allow any other domain, and it does not allow the bare velaro.com (add it separately if you need it). Some security reviews prefer explicit lists for this reason. If yours does, use Option 2.

Option 3: Wildcard Plus the Two Azure Hosts (Existing Velaro Chat Install)

Use this if your Velaro Chat widget code was installed some time ago and you want the shortest policy that works. Allow these, with the same directives as Option 1:

Host	Directive	Why
https://*.velaro.com and wss://*.velaro.com	script-src, connect-src, frame-src, img-src	Every Velaro host the widget uses, including signalr-engagement-app-prd.velaro.com, livefluence-asrs-eastus.velaro.com and cobrowse.velaro.com
eastprodcdn.azureedge.net	script-src, frame-src, img-src	Widget scripts and images for installs that still load from it
galleryuseastprod.blob.core.windows.net	img-src, media-src	Chat images and files for installs that still load from it

Keep any other Velaro entry you already have, including *.service.signalr.net and velaromessagingprod.blob.core.windows.net if you use Velaro Messaging. Newer installs load the chat connection from velaro.com hosts, but most accounts, new ones included, still receive their widget scripts and files from the two Azure hosts above until Velaro switches your account to its own names (cdn-us-east.velaro.com and storage.velaro.com). Keep the two Azure hosts in your policy until Velaro confirms that switch for your account; the velaro.com wildcard already covers the new names, so nothing else changes when it happens.

Option 2: Explicit List for Both Platforms

Allow every host below. Real-time hosts need both https:// and wss:// entries: the browser first makes an HTTPS request to start the connection, then opens the WebSocket.

Velaro Hosts (under velaro.com)

Platform	Host	Directive	Purpose
Velaro Chat	api-main-us-east.velaro.com	connect-src	Account and widget settings
Velaro Chat	api-visitor-us-east.velaro.com	connect-src	Visitor sessions and invitations
Velaro Chat	api-engagement-us-east.velaro.com	connect-src	Chat and availability
Velaro Chat	api-routing-us-east.velaro.com	connect-src	Routing (call and queue widgets)
Velaro Chat	signalr-engagement-us-east.velaro.com (https and wss)	connect-src	Real-time chat
Velaro Chat	signalr-engagement-app-prd.velaro.com (https and wss)	connect-src	Real-time chat
Velaro Chat	livefluence-asrs-eastus.velaro.com (https and wss)	connect-src	Real-time chat
Velaro Chat	cobrowse.velaro.com (https and wss)	connect-src	Co-browsing (the agent sees and guides the visitor's page)
Velaro Chat	storage.velaro.com	img-src, media-src	Chat images and files
Velaro Chat	cdn-us-east.velaro.com	script-src, frame-src, img-src	Widget scripts and images
Velaro Messaging	messaging.velaro.com	script-src, frame-src, connect-src	Widget script and chat window
Velaro Messaging	workspace.velaro.com	script-src, frame-src, connect-src	Widget script and chat window (alternate host)
Velaro Messaging	api-messaging-us-east.velaro.com	connect-src	Messaging API

Hosts Not Under velaro.com

Some content and real-time connections are currently served from Microsoft Azure host names. They are not covered by *.velaro.com, so Option 1 lists them separately.

Host	Directive	Purpose
eastprodcdn.azureedge.net	script-src, frame-src, img-src	Velaro Chat widget scripts and images
galleryuseastprod.blob.core.windows.net	img-src, media-src	Velaro Chat images and files
velaromessagingprod.blob.core.windows.net	img-src, media-src	Velaro Messaging images, files and sounds
*.service.signalr.net (https and wss)	connect-src	Real-time connections (Azure SignalR Service)

If you only run one platform, you only need that platform's rows and the shared rows (*.service.signalr.net). We still recommend listing all of them, because accounts can move between platforms and Velaro may route a service through any host listed here.

Which Hosts Does My Installed Script Use?

The Velaro Chat widget script loads its own hosts when it runs. Scripts installed or regenerated before this change may load content from the Microsoft-hosted names above, and some current ones still do. For that reason, keep the entries in the table above, even if you recently reinstalled the script. Listing them is the safe choice, and it keeps both older and newer installed scripts working without any change on your side.

Using a nonce or a hash? See Content Security Policy (CSP) and Velaro for nonce and hash examples in common server languages.

Keeping Your Policy Current

Hosts under velaro.com may be added or changed over time. If you use Option 1, you do not need to change anything for those. If you use Option 2, or you list the hosts that are not under velaro.com, keeping your policy up to date is your responsibility. Where we can, we aim to tell account contacts about host changes in advance, but we do not guarantee notice or timing.

Testing Your Policy

1. Update your CSP, then reload the page that hosts the chat, signed in if your site requires it. A logged-in area often sends a different policy than your public pages.
2. Open your browser developer tools and look in the Console for messages that begin with "Refused to load" or "Refused to connect". The host named in the message is the one to add.
3. Start a chat, have an agent accept and reply, and confirm the reply appears.

Symptom	Likely cause	Fix
Widget does not load ("Refused to execute script")	Missing script-src entry	Add the script hosts
Chat opens but agent replies do not appear	A real-time host is missing from connect-src	Add the real-time hosts with both https:// and wss://
Chat window is blank	Missing frame-src entry	Add the widget hosts to frame-src
Images, files or sounds missing	Missing img-src or media-src entry	Add the storage hosts

Velaro Messaging also supports a nonce on the embed script tag in addition to host allow-listing.

Important Information

Your Content Security Policy is your own decision and your own responsibility. This article is general information about the hosts our products use as of the date above. It is not security, legal or implementation advice, and it is provided as is, without any warranty or guarantee that a policy built from it will meet your requirements or work with your site. Velaro does not configure, review or approve your policy and is not responsible for content that your policy blocks or allows. Please review any change with your own security team and test it before deploying it.

Velaro CLI 1.4.104 → 1.4.106: updating in the background (VELARO_NO_AUTO_UPDATE=1 to disable). (node:27808) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated. (Use `node --trace-deprecation ...` to show where the warning was created)