> ## Documentation Index
> Fetch the complete documentation index at: https://docs.invoca.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuring Content Security Policy (CSP) for the Invoca Tag

> Add Invoca's JS library, Tag, and API endpoints to your site's Content Security Policy so the Tag isn't blocked from running.

To make sure the Invoca Tag can run properly without being blocked by a Content Security Policy (CSP), you need to modify the CSP configuration for your website. This involves adjusting the `Content-Security-Policy` HTTP header for your web server, or the `<meta>` tag in your webpage's HTML, to include the locations of the Invoca JS library and Tag, and the Invoca endpoint the Tag connects to for collecting attribution and swapping phone numbers.

## CSP directives

A CSP uses directives to define what sources of content are allowed. The two directives relevant to Invoca are:

* `connect-src`: allowed sources for API requests (such as XMLHttpRequest, WebSocket, and EventSource)
* `script-src`: allowed sources for JavaScript

Each directive can have multiple sources, separated by spaces:

```text theme={null}
connect-src mysource.example.com mysource2.example.com mysource3.example.com ...;
```

## Invoca sources

**For US accounts:**

* `solutions.invocacdn.com` — add to `connect-src`
* `pnapi.invoca.net` — add to both `connect-src` and `script-src`

**For EU accounts:**

* `solutions.eu.invocacdn.com` — add to `connect-src`
* `pnapi.eu.invoca.net` — add to both `connect-src` and `script-src`

### Examples

**For US accounts:**

```text theme={null}
Content-Security-Policy: script-src 'self' solutions.invocacdn.com pnapi.invoca.net; connect-src 'self' pnapi.invoca.net;
```

* `'self'`: allows connections to your own domain
* `solutions.invocacdn.com`: allows loading of Invoca JS and Tag scripts
* `pnapi.invoca.net`: allows connections to Invoca for number swapping

**For EU accounts:**

```text theme={null}
Content-Security-Policy: script-src 'self' solutions.eu.invocacdn.com pnapi.eu.invoca.net; connect-src 'self' pnapi.eu.invoca.net;
```

## Implementation methods

**HTTP header:** The most common way to implement CSP is by setting the `Content-Security-Policy` HTTP header on your web server.

**HTML meta tag:** You can also use a `<meta>` tag in your HTML:

```html theme={null}
<meta http-equiv="Content-Security-Policy" content="script-src 'self' solutions.invocacdn.com pnapi.invoca.net; connect-src 'self' pnapi.invoca.net;">
```

## Where to go next

* [The Invoca Tag Is Not Loaded Because It Violates Content Security Policy (CSP)](/s/article/tag-not-loaded-csp-violation)
* [Cookie Classification](/s/article/cookie-classification)