CSP requirements - Rivvi Help Center

If your website enforces a Content Security Policy, allow the Rivvi web-chat widget’s hosts. Everything the widget loads — the embed script, the LiveKit client library, and the session/event calls — is served from the Rivvi API host. There is no third-party CDN to allow.

Directives

Replace the API host with your environment’s host (production shown; use https://beta-api.rivvi.ai on beta).

Directive	Hosts	Why
`script-src`	`https://api.rivvi.ai`	`embed.js` and the version-pinned `livekit-client` are first-party to the API host.
`connect-src`	`https://api.rivvi.ai`	Session mint, consent, and analytics beacons.
`connect-src`	your LiveKit WebSocket host (`wss://…`)	The realtime chat connection. Find it in your LiveKit config (`LIVEKIT_URL`).

embed.js is served same-origin to the API host and self-hosts the LiveKit client library — so you do not need to allow cdn.jsdelivr.net or any other CDN. Earlier widget versions loaded LiveKit from jsDelivr; the current widget does not.

Example

Content-Security-Policy:
  script-src 'self' https://api.rivvi.ai;
  connect-src 'self' https://api.rivvi.ai wss://your-livekit-host.livekit.cloud;

If the widget doesn’t appear and your browser console shows a CSP violation for api.rivvi.ai, add the host to the directive named in the error. If chat opens but never connects, the missing host is usually your LiveKit wss:// host under connect-src.