https://cdn.helpalive.com to script-src, and https://api.helpalive.com and https://chat.helpalive.com to connect-src. This page is for developers whose app sends a Content-Security-Policy header. It lists the sources HelpAlive needs, and how to keep a strict, nonce-based policy. Most apps don’t send one and can skip this page.
Content Security Policy at a glance
script-srcneedshttps://cdn.helpalive.com, which loads our script and the agent and assist code it adds.connect-srcneedshttps://api.helpalive.comfor activity andhttps://chat.helpalive.comfor the agent.- You add these sources to your policy without removing anything.
- You don’t need a
style-srcchange or'unsafe-inline'. - With a nonce-based policy, you put the page’s nonce on the HelpAlive tag, and HelpAlive puts it on every script it adds.
Prerequisites
- The HelpAlive tag is in your pages. See Install the script.
- You can change the policy your server or framework sends.
What to add
Add these sources to the policy you already have, without removing anything:
Without
chat.helpalive.com, the script loads and activity arrives, but the agent never appears.
You don’t need a style-src change or 'unsafe-inline'.
How to use a nonce
If yourscript-src uses a nonce, put the page’s nonce on the HelpAlive tag, the same way your other scripts get theirs:
1
Render the nonce into the tag
Your server makes a fresh nonce for each response and puts it in the policy header. Print the same value into the tag’s
nonce attribute.2
Leave the rest to HelpAlive
HelpAlive reads the nonce from its own tag and puts it on every script it adds. With
'strict-dynamic' in your policy, those scripts are allowed anyway.nonce attribute. There is no HelpAlive-specific nonce attribute.
With Google Tag Manager
If you load HelpAlive through Google Tag Manager, your policy must already allow Tag Manager’s Custom HTML tags. Add our sources as well.Check it works
1
Open your app with the browser console open
Sign in, so that
identify() runs and the agent can load.2
Look for policy errors
A blocked request shows as a console error that names
Content Security Policy and one of our hosts. No such error means that the policy lets HelpAlive through.3
Confirm on the setup page
Load a page of your app, then come back to Settings → Setup & API Key. Step Add HelpAlive to your app no longer says “Not on your pages yet.” Once you sign in, it gets a check. Once the agent is on, the chat button appears in your app.
Why does the script never load?
The script never loads whenscript-src lacks https://cdn.helpalive.com, or when your policy uses a nonce and the tag has none. The console names the blocked script.
Why does activity arrive, but the agent never appears?
Activity arrives without the agent whenconnect-src lacks https://chat.helpalive.com. This means the agent’s settings can’t load, so its button never shows.
What does report-only mode do?
Report-only mode means that aContent-Security-Policy-Report-Only header blocks nothing. It only reports. Fix what it reports before you switch it to enforcing.
Next
Install the script
The tag, identify() and reset().
Troubleshooting
The failures that show no error.
Security overview
Keys, verified users and sessions.