A Content Security Policy is an HTTP response header that tells the browser which scripts are allowed to run on your page. If your site uses CSP, you need to authorize the Velaro domains or the widget will be blocked — or, for the Velaro Messaging platform, use nonce-based authorization instead of domain allowlisting. See which section below applies to your platform.

Which platform does your site use? If your embed script loads from eastprodcdn.azureedge.net or is booted via Velaro('boot', {...}), you're on the Velaro Chat widget — use the "Velaro Chat Widget" section below. If your embed script loads from cdn.velaro.com/messenger/embed.js or messaging.velaro.com, you're on Velaro Messaging — use the "Velaro Messaging" section below. If you're not sure, contact Velaro Support.

Velaro Chat Widget

Required: add Velaro to your CSP

Add these entries to your Content-Security-Policy header:

Content-Security-Policy:
  script-src  'self' https://eastprodcdn.azureedge.net;
  connect-src 'self' https://api-visitor-us-east.velaro.com
                     https://api-engagement-us-east.velaro.com
                     https://signalr-engagement-us-east.velaro.com
                     wss://signalr-engagement-us-east.velaro.com;
  img-src     'self' data: https://eastprodcdn.azureedge.net;

• script-src https://eastprodcdn.azureedge.net allows the Velaro widget scripts (shim and chat bundle) to load and run
• connect-src allows the widget to reach the visitor API, engagement API, and the real-time chat hub (REST and WebSocket)
• img-src https://eastprodcdn.azureedge.net allows agent avatars and widget images to display

You do not need 'unsafe-eval' or 'unsafe-inline'.

Why you need the CDN domain, not just a nonce

The Velaro Chat widget loads in two stages. The shim script runs on your page and then loads the chat bundle inside a sandboxed iframe. Because the iframe is a separate document context, 'strict-dynamic' trust propagation from a nonce-authorized script does not reliably reach it across all browsers. Adding https://eastprodcdn.azureedge.net to script-src is the browser-consistent solution that covers both stages. A nonce on the embed tag alone does not guarantee the iframe load is permitted.

Troubleshooting — Velaro Chat

---

Velaro Messaging

Velaro Messaging's embed script (cdn.velaro.com/messenger/embed.js) supports nonce-based CSP authorization as an alternative to domain allowlisting — available on every subscription plan, no upgrade required. If your site generates a fresh CSP nonce per request, add it directly to the Velaro embed tag instead of listing CDN domains in script-src:

<script src="https://cdn.velaro.com/messenger/embed.js"
        nonce="YOUR_SERVER_GENERATED_NONCE"
        data-site-id="YOUR_SITE_ID"></script>

Velaro Messaging's loader captures that nonce once, synchronously, from the exact script tag that loaded it, and applies it to every script and style element the widget subsequently creates in your page — so dynamically-created elements stay authorized without you needing to allowlist the CDN domain itself. If you'd rather use domain allowlisting instead of a nonce, that continues to work exactly like the Velaro Chat widget's approach above (substitute Velaro Messaging's own CDN/API domains, which differ from the legacy Velaro Chat domains listed in the previous section — contact Velaro Support for your account's exact domain list if you need the allowlist approach).

CSP directive reference — Velaro Messaging

Content-Security-Policy:
  script-src  'nonce-<YOUR_NONCE>';
  connect-src https://*.velaro.com wss://*.velaro.com;
  style-src   'unsafe-inline';
  img-src     * data:;

• script-src 'nonce-<YOUR_NONCE>' authorizes the embed script and every element it creates afterward, since the nonce is propagated automatically
• connect-src allows the widget's API and real-time connections
• style-src 'unsafe-inline' is still required — the widget applies inline styles for positioning and theming, same as the Velaro Chat widget

Widget framing and consent-management stability

Velaro Messaging's widget loader has been hardened for more consistent behavior across strict CSP and cookie-consent-management (CMP) configurations — the loader and its iframe framing degrade gracefully rather than silently failing when a CMP blocks or delays script execution. If your site also uses a consent-management platform, see Velaro Messaging — Cookie Consent for the automatic consent-mode configuration.

See also

• Velaro Release Notes for the latest platform updates
• Cookie Consent and GDPR Compliance for the Velaro Chat Widget if your site uses the legacy Velaro Chat widget and a consent management platform
• Velaro Messaging — Cookie Consent if your site uses Velaro Messaging