Skip to main content
If your site sets a Content Security Policy, the widget needs a few extra sources. Add them to your policy or the widget does not load.

​
Directives

​
Example header

Keep your own sources in each directive. This example adds the widget sources to a policy that already allows your own origin.
The widget runs the Turnstile bot check in a frame from https://api.paperlinkai.com. Your page does not load https://challenges.cloudflare.com itself, so your policy does not need that source. A policy that still lists it continues to work. If your page sends Cross-Origin-Embedder-Policy: require-corp, the browser blocks the frame and the check fails.
Without style-src 'unsafe-inline', the widget loses its styles. The widget injects its stylesheet into its shadow root, so this source is required today.

Conversations, resume and browser storage

See what the widget stores in the visitor’s browser.