{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-embeds/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition","tabs","tab"]},"type":"markdown"},"seo":{"title":"Content Security Policy","description":"Checkr developer documentation for background check APIs, embeds, and partner integrations."},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"content-security-policy","__idx":0},"children":["Content Security Policy"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Embeds rely on ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["style"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["script"]}," elements rendered inside the iframe. If your application uses a ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"},"children":["Content Security Policy"]},", these elements might be blocked by your rules. To avoid this, permit the following sources in your policy. If you are installing the Checkr WebSDK library via CDN, additionally add the CDN source to the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["script-src"]}," header."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"CSP Header"},"children":["CSP Header"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Sources"},"children":["Sources"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":""},"children":[]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["frame-src"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["https://web-sdk-services.checkr.com"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["script-src"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["https://web-sdk-services.checkr.com"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["https://cdn.jsdelivr.net/npm/@checkr/web-sdk"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If you are using a Checkr staging account, you will need to add sources for Staging as well."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"CSP Header"},"children":["CSP Header"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Sources"},"children":["Sources"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":""},"children":[]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["frame-src"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["https://web-sdk-services.checkr-staging.com"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["script-src"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["https://web-sdk-services.checkr-staging.com"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["https://cdn.jsdelivr.net/npm/@checkr/web-sdk"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"cspnonce","__idx":1},"children":["cspNonce"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["cspNonce"]}," can be used to pass a ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://developer.mozilla.org/en-US/docs/Web/HTML/Global_attributes/nonce"},"children":["nonce"]}," to all inline ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["style"]}," elements rendered by Embeds."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Note:"]}," Nonces should be generated differently each time the page loads and should be a random base64-encoded string of at least 128 bits of data from a cryptographically secure random number generator. If your site uses static html, consider using a CSP ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://content-security-policy.com/hash"},"children":["hash"]}," instead."]}]},{"$$mdtype":"Tag","name":"Tabs","attributes":{"size":"medium"},"children":[{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":"JavaScript","disable":false},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"javascript","header":{"controls":{"copy":{}}},"source":"const crypto = require('crypto')\nconst cspNonce = crypto.randomBytes(16).toString('base64') // '8IBTHwOdqNKAWeKl7plt8g=='\n\nconst embed = new Checkr.Embeds.NewInvitation({ cspNonce })\n","lang":"javascript"},"children":[]}]},{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":"React","disable":false},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"jsx","header":{"controls":{"copy":{}}},"source":"const crypto = require('crypto')\nconst cspNonce = crypto.randomBytes(16).toString('base64') // '8IBTHwOdqNKAWeKl7plt8g=='\n\n<NewInvitation cspNonce={cspNonce} />\n","lang":"jsx"},"children":[]}]}]}]},"headings":[{"value":"Content Security Policy","id":"content-security-policy","depth":1},{"value":"cspNonce","id":"cspnonce","depth":3}],"frontmatter":{"title":"Content Security Policy","description":"Configure your Content Security Policy to allow Checkr Embeds to load style and script elements inside iframes.","seo":{"title":"Content Security Policy"}},"lastModified":"2026-09-18T05:44:09.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/embeds/content-security-policy","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}