---
description: How Adobe Experience Platform Tags supports Content Security Policy nonces, and how to send CSP violation reports to Report URI.
---

# Adobe Experience Platform Tags

Adobe Experience Platform Tags, previously Adobe Launch, injects inline scripts into your pages on behalf of the extensions and rules you configure. Under a strict CSP those injections are blocked unless they carry a nonce, and the Core extension has a setting for exactly that.

## What Adobe Experience Platform Tags gives you

- A nonce configuration on the Core extension: create a data element that references where the nonce appears on the page, point the Core extension at it, and every inline script Tags adds will carry that nonce.
- Nonce support requires **asynchronous** deployment of the Tags library.
- Adobe-hosted libraries load from `assets.adobedtm.com`, so that domain needs allowing in `script-src`. Self-hosted libraries only need `'self'`.
- `'unsafe-inline'` is documented as a fallback, and Adobe is explicit that it is the least secure option.

## Sending reports to Report URI

Adobe's guidance does not cover reporting, so add the directive to the policy you serve from your own application. Your URL comes from the [Setup](https://report-uri.com/account/setup/) page:

    Content-Security-Policy-Report-Only: script-src 'self' assets.adobedtm.com 'nonce-{random}'; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly

## Things to watch for

- The nonce setting only covers scripts that Tags itself injects. Custom code inside a rule that violates your policy is still blocked - the CSP wins.
- The nonce has to change on every page load. If your pages are cached, make sure the nonce is not cached with them.
- Like any tag manager, Tags lets people add scripts to your pages without a code deployment. [Script Watch](/setup/script-watch/) will tell you when the set of scripts on a page changes.

## Official documentation

[Adobe - Content Security Policy](https://experienceleague.adobe.com/en/docs/experience-platform/tags/client-side/content-security-policy)

## Start Monitoring with Report URI

**Already using us for CSP?** Find your report-uri value on [Setup](https://report-uri.com/account/setup/), or view your [CSP reports](https://report-uri.com/account/reports/csp/).

**New to Report URI?** Create an account and grab your report-uri value from the [Setup](https://report-uri.com/account/setup/) page.

[Start your free trial](https://report-uri.com/register/?plan=starter2025)