> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rivvi.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# CSP requirements

> Content Security Policy directives the web-chat widget needs.

If your website enforces a [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP),
allow the Rivvi web-chat widget's hosts. Everything the widget loads — the embed
script, the LiveKit client library, and the session/event calls — is served from
the **Rivvi API host**. There is no third-party CDN to allow.

## Directives

Replace the API host with your environment's host (production shown; use
`https://beta-api.rivvi.ai` on beta).

| Directive     | Hosts                                   | Why                                                                                 |
| ------------- | --------------------------------------- | ----------------------------------------------------------------------------------- |
| `script-src`  | `https://api.rivvi.ai`                  | `embed.js` and the version-pinned `livekit-client` are first-party to the API host. |
| `connect-src` | `https://api.rivvi.ai`                  | Session mint, consent, and analytics beacons.                                       |
| `connect-src` | your LiveKit WebSocket host (`wss://…`) | The realtime chat connection. Find it in your LiveKit config (`LIVEKIT_URL`).       |

<Note>
  `embed.js` is served **same-origin to the API host** and self-hosts the LiveKit
  client library — so you do **not** need to allow `cdn.jsdelivr.net` or any other
  CDN. Earlier widget versions loaded LiveKit from jsDelivr; the current widget does
  not.
</Note>

## Example

```
Content-Security-Policy:
  script-src 'self' https://api.rivvi.ai;
  connect-src 'self' https://api.rivvi.ai wss://your-livekit-host.livekit.cloud;
```

If the widget doesn't appear and your browser console shows a CSP violation for
`api.rivvi.ai`, add the host to the directive named in the error. If chat opens
but never connects, the missing host is usually your LiveKit `wss://` host under
`connect-src`.