Content Security Policy (CSP)

To ensure seamless functionality of the Vida Web SDK, update your Content Security Policy (CSP) and network whitelist to allow the following resource:

script-src

Content-Security-Policy: script-src 'self' https://web-sdk.vida.id https://shield.vida.id; 'wasm-unsafe-eval';

'wasm-unsafe-eval' is required for face detection (WebAssembly).

Additional CSP Directives (Only required if you have these directives enforcement)

The SDK also makes API calls and loads additional resources based on the workflow configs. Add the following to your connect-src and img-src.

Production Env

connect-src 'self' https://sdk-api.prod.vida.id https://shield.vida.id https://faro-collector-prod-ap-southeast-1.grafana.net https://vida-prod-tijori-1.s3.ap-southeast-3.amazonaws.com;
img-src 'self' https://pixel-shield.vida.id;

Note: https://shield.vida.id & https://pixel-shield.vida.id are required only if you have ID Fraud shield enabled

https://vida-prod-tijori-1.s3.ap-southeast-3.amazonaws.com is required only if you have liveness color flash enabled

Sandbox Env

script-src 'self' https://web-sdk.vida.id https://sandbox-shield.vida.id; 'wasm-unsafe-eval';
connect-src 'self' https://sandbox-sdk-api.np.vida.id https://sandbox-shield.vida.id https://faro-collector-prod-ap-southeast-2.grafana.net https://vida-sandbox-tijori-1.s3.ap-southeast-3.amazonaws.com;
img-src 'self' https://sandbox-pixel-shield.vida.id;

Note:https://sandbox-shield.vida.id & https://sandbox-pixel-shield.vida.id are required only if you have ID Fraud shield enabled

https://vida-sandbox-tijori-1.s3.ap-southeast-3.amazonaws.com is required only if you have liveness color flash enabled

Tip: You can use https://*.vida.id in place of individual subdomains if your policy allows wildcards. The Grafana collector ( used for error/crash logging ) and the S3 upload hosts ( used only for color flash ) must always be added explicitly.

Network / Firewall Whitelist

Allow outbound HTTPS (port 443) to: (only needed if SDK is used in an environment that enforces egress filtering or outbound firewall rules)

Production

web-sdk.vida.id 
sdk-api.prod.vida.id 
shield.vida.id 
pixel-shield.vida.id 
faro-collector-prod-ap-southeast-1.grafana.net
vida-prod-tijori-1.s3.ap-southeast-3.amazonaws.com

Sandbox

web-sdk.vida.id 
sandbox-sdk-api.np.vida.id 
sandbox-shield.vida.id 
sandbox-pixel-shield.vida.id 
faro-collector-prod-ap-southeast-2.grafana.net
vida-sandbox-tijori-1.s3.ap-southeast-3.amazonaws.com

Tip: Use *.vida.id to cover all Vida-owned hosts with a single rule. The Grafana collector and the S3 upload host must still be whitelisted explicitly.

No inbound ports are required. If TLS inspection is enabled, exclude these hosts to avoid certificate failures.