Script and connections
For the standard installation, the widget script is served from https://app.message.com/widget.js. Allow that script origin and connections to https://app.message.com and wss://app.message.com for its HTTP and real-time transport. A custom data-server value changes the connection origin.
Inline loader and widget styles
The dashboard snippet includes an inline loader. Your site must authorize that loader using its own CSP nonce or hash, or use an approved external loading approach. The widget injects styles inside Shadow DOM; a strict style policy must account for those too. There is no documented data-nonce attribute that automatically solves this.
Images, uploads and media
Your logo, attachments and recordings may load from additional storage origins. Check actual browser requests before adding those origins to the appropriate image or media policy. Start in report-only mode and test opening chat, sending a message and any enabled upload or audio features.
Keep going
Put the next step into practice, or ask us about your setup.