Skip to Content

This guide shows you how to let the SDK work under a Content Security Policy. Skip it if your app doesn’t send a Content-Security-Policy header or meta tag.

  1. Add these sources to the matching directives in your existing policy:

    DirectiveAddWhy
    frame-srchttps://embedded-wallet.mydoge.comThe embedded wallet runs in a frame
    connect-srchttps://relay.mydoge.com https://wallet.mydoge.com https://web3-assets.mydoge.comSign-in, wallet data and chain data
    form-actionhttps://relay.mydoge.com https://accounts.google.com https://x.com https://twitter.comSign-in posts a form that redirects to Google or X
    img-srchttps://web3-assets.mydoge.com data:Wallet and chain icons
    style-src'unsafe-inline'The SDK adds its styles in a <style> tag

  2. If you enable WalletConnect, also add:

    DirectiveAdd
    connect-srcwss://relay.walletconnect.org https://rpc.walletconnect.org https://pulse.walletconnect.org
    frame-srchttps://verify.walletconnect.org https://verify.walletconnect.com

  3. Keep the sources your app already needs, such as your chain’s RPC endpoint. These directives cover only the SDK; they aren’t a complete policy for your app.

  4. Open the wallet modal and sign in with email, then with Google and with X. If something is blocked, the browser console names the directive and the source to add.