> For the complete documentation index, see [llms.txt](https://docs.vida.id/identity-stack/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vida.id/identity-stack/verify/web-sdk/content-security-policy-csp-whitelist.md).

# Content Security Policy (CSP) Whitelist

To ensure the seamless functionality of the Vida Web SDK, update your Content Security Policy (CSP) whitelist to allow the following scripts and resources:

This table provides a clear view of the URLs and their purposes for your CSP whitelist.

| **URL**                                   | **Purpose**                                                                                                                                                                         |
| ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| <https://web-sdk.vida.id>                 | Used for downloading the Vida SDK code itself.                                                                                                                                      |
| <https://cdn.jsdelivr.net>                | Used for downloading Mediapipe WebAssembly files (e.g., [link](https://cdn.jsdelivr.net/npm/@mediapipe/tasks-vision@0.10.3/wasm)).                                                  |
| <https://storage.googleapis.com>          | Used for downloading Mediapipe face landmark models (e.g., [link](https://storage.googleapis.com/mediapipe-models/face_landmarker/face_landmarker/float16/1/face_landmarker.task)). |
| <https://www.datadoghq-browser-agent.com> | Used to download the Datadog RUM SDK for logging errors or crashes (e.g., [link](https://www.datadoghq-browser-agent.com/eu1/v5/datadog-rum.js)).                                   |

#### Example CSP Update

Make sure these domains are added to your CSP directives, such as `script-src` and `connect-src`:

```plaintext
Content-Security-Policy: 
script-src 'self' https://web-sdk.vida.id https://cdn.jsdelivr.net https://storage.googleapis.com https://www.datadoghq-browser-agent.com; 
connect-src 'self' https://web-sdk.vida.id https://cdn.jsdelivr.net https://storage.googleapis.com https://www.datadoghq-browser-agent.com;
```

By adding these URLs to your CSP configuration, you ensure that the SDK and its dependencies load and function correctly.