> ## Documentation Index
> Fetch the complete documentation index at: https://docs.invoca.com/llms.txt
> Use this file to discover all available pages before exploring further.

# The Invoca Tag Is Not Loaded Because It Violates Content Security Policy (CSP)

> If your Content Security Policy doesn't allowlist Invoca's script and connection sources, the Tag will silently fail to load — here's how to confirm it and fix it.

## Symptoms

The Tag is deployed via Google Tag Manager but doesn't load on the website. The Chrome DevTools console shows an error similar to: "Refused to load the script [https://solutions.invocacdn.com/js/invoca-latest.min.js…](https://solutions.invocacdn.com/js/invoca-latest.min.js…)"

## Cause

A Content Security Policy (CSP) protects web applications from attacks like cross-site scripting or data injection by letting developers define which resources can load and execute. This can unintentionally block the Invoca Tag if its script source isn't included in the policy.

## Resolution

**Confirm the cause:** Install the Chrome extension "Disable Content Security Policy" from the Chrome Web Store, enable it, then revisit the site. If the Tag loads successfully with the extension enabled, the issue is your CSP.

**Fix it:** Add the Invoca script source to your CSP allowlist.

* **For US accounts:** `solutions.invocacdn.com` (Invoca Tag script), `pnapi.invoca.net` (number swap request)
* **For EU accounts:** `solutions.eu.invocacdn.com` (Invoca Tag script), `pnapi.eu.invoca.net` (number swap request)

Files in different paths under the same domain are subject to the same CSP restrictions. Update your CSP one of two ways:

**Update the CSP header in your server configuration:**

```text theme={null}
Content-Security-Policy: script-src 'self' solutions.invocacdn.com pnapi.invoca.net; connect-src 'self' pnapi.invoca.net;
```

**Update the `<meta>` tag in your HTML:**

```html theme={null}
<meta http-equiv="Content-Security-Policy" content="script-src 'self' solutions.invocacdn.com pnapi.invoca.net; connect-src 'self' pnapi.invoca.net;">
```

This allows the script from the specified sources (`'self'`, `solutions.invocacdn.com`, and `pnapi.invoca.net`) to load.

## Where to go next

* [Configuring Content Security Policy (CSP) for the Invoca Tag](/s/article/content-security-policy)