Skip to main content
Add Invoca’s JS library, Tag, and API endpoints to your site’s Content Security Policy so the Tag isn’t blocked from running.
To make sure the Invoca Tag can run properly without being blocked by a Content Security Policy (CSP), you need to modify the CSP configuration for your website. This involves adjusting the Content-Security-Policy HTTP header for your web server, or the <meta> tag in your webpage’s HTML, to include the locations of the Invoca JS library and Tag, and the Invoca endpoint the Tag connects to for collecting attribution and swapping phone numbers.

​
CSP directives

A CSP uses directives to define what sources of content are allowed. The two directives relevant to Invoca are:
  • connect-src: allowed sources for API requests (such as XMLHttpRequest, WebSocket, and EventSource)
  • script-src: allowed sources for JavaScript
Each directive can have multiple sources, separated by spaces:

​
Invoca sources

For US accounts:
  • solutions.invocacdn.com — add to connect-src
  • pnapi.invoca.net — add to both connect-src and script-src
For EU accounts:
  • solutions.eu.invocacdn.com — add to connect-src
  • pnapi.eu.invoca.net — add to both connect-src and script-src

​
Examples

For US accounts:
  • 'self': allows connections to your own domain
  • solutions.invocacdn.com: allows loading of Invoca JS and Tag scripts
  • pnapi.invoca.net: allows connections to Invoca for number swapping
For EU accounts:

​
Implementation methods

HTTP header: The most common way to implement CSP is by setting the Content-Security-Policy HTTP header on your web server. HTML meta tag: You can also use a <meta> tag in your HTML:

​
Where to go next

Last modified on September 21, 2026