> ## Documentation Index
> Fetch the complete documentation index at: https://paperlinkai.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Content Security Policy

> The CSP directives your site needs so the widget loads and talks to Paperlink AI.

If your site sets a Content Security Policy, the widget needs a few extra sources. Add them to your policy or the widget does not load.

## Directives

| Directive | Add |
| - | - |
| `script-src` | `https://api.paperlinkai.com` |
| `connect-src` | `https://api.paperlinkai.com` |
| `frame-src` | `https://api.paperlinkai.com` (the Turnstile bot check) |
| `img-src` | `https://api.paperlinkai.com` (bot icon) and `https://img.clerk.com` (workspace logo fallback) |
| `style-src` | `'unsafe-inline'` |

## Example header

Keep your own sources in each directive. This example adds the widget sources to a policy that already allows your own origin.

```http theme={"dark"}
Content-Security-Policy: script-src 'self' https://api.paperlinkai.com; connect-src 'self' https://api.paperlinkai.com; frame-src https://api.paperlinkai.com; img-src 'self' https://api.paperlinkai.com https://img.clerk.com; style-src 'self' 'unsafe-inline'
```

> [!NOTE]
>
> The widget runs the Turnstile bot check in a frame from `https://api.paperlinkai.com`. Your page does not load `https://challenges.cloudflare.com` itself, so your policy does not need that source. A policy that still lists it continues to work. If your page sends `Cross-Origin-Embedder-Policy: require-corp`, the browser blocks the frame and the check fails.

> [!WARNING]
>
> Without `style-src 'unsafe-inline'`, the widget loses its styles. The widget injects its stylesheet into its shadow root, so this source is required today.

> **[Conversations, resume and browser storage](https://paperlinkai.com/docs/developers/security/conversations-and-storage.md)**
>
> See what the widget stores in the visitor's browser.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.