If your site sends a Content-Security-Policy header (you can check with curl -I yoursite.com), you may need to extend it for our widget to load.
The directives
script-src: 'https://cdn.message.com'. connect-src: 'https://api.message.com', 'wss://realtime.message.com'. img-src: 'https://cdn.message.com', 'data:'. style-src: 'https://cdn.message.com', 'unsafe-inline' (or use a nonce).
Nonce-based CSP
If you use nonces, our loader supports the data-nonce attribute. Pass your per-request nonce on the script tag and the loader propagates it to inline styles.