---
description: The Content Security Policy directives Braintree requires, including the 3D Secure caveat, and how to send CSP violation reports to Report URI.
---

# Braintree

Braintree publishes a full CSP configuration, split by whether you have AJAX/CORS enabled. The list is longer than most payment integrations because the components pull in PayPal, Google Pay and 3D Secure infrastructure alongside Braintree's own domains.

Integrating the PayPal JS SDK directly rather than through Braintree? That has its own guidance - see our [PayPal](/platforms/paypal/) page.

## What Braintree requires

With AJAX/CORS enabled, the documented directives are:

- `script-src` - `js.braintreegateway.com`, `assets.braintreegateway.com`, `www.paypalobjects.com`, `c.paypal.com`
- `style-src` - `'unsafe-inline'`
- `img-src` - `assets.braintreegateway.com`, `checkout.paypal.com`, `data:`
- `child-src` and `frame-src` - `assets.braintreegateway.com`, `c.paypal.com`, `*.cardinalcommerce.com`
- `connect-src` - the Braintree API endpoints for your environment

Sandbox and production use different endpoints, so a policy tuned in sandbox will not necessarily work in production.

## Sending reports to Report URI

Add a reporting directive alongside the Braintree directives. Your URL comes from the [Setup](https://report-uri.com/account/setup/) page:

    Content-Security-Policy-Report-Only: script-src 'self' js.braintreegateway.com assets.braintreegateway.com www.paypalobjects.com c.paypal.com; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly

## Things to watch for

- **3D Secure breaks strict policies by design.** Braintree's documentation is explicit: if you use 3D Secure, set `frame-src` and `form-action` to `*`. 3D Secure 2 frames the issuing bank's ACS URL, that URL varies by issuer and ACS provider and changes regularly, so no enumerated list can cover it. PCI DSS 6.4.3 exempts the 3D Secure step for the same reason.
- `style-src 'unsafe-inline'` is required, which is a genuine weakening. Keep it scoped to `style-src` and do not let it leak into `script-src`.
- Adding the PayPal Checkout, Google Pay or 3D Secure components each pulls in additional directives. A policy that was clean before you enabled a new payment method will not stay clean.

## Official documentation

[Braintree - Best Practices and Troubleshooting](https://developer.paypal.com/braintree/docs/reference/client-reference/javascript/v2/best-practices)

## Start Monitoring with Report URI

**Already using us for CSP?** Find your report-uri value on [Setup](https://report-uri.com/account/setup/), or view your [CSP reports](https://report-uri.com/account/reports/csp/).

**New to Report URI?** Create an account and grab your report-uri value from the [Setup](https://report-uri.com/account/setup/) page. Working towards PCI DSS 4.0? Start with our [Compliance](/compliance/) guides.

[Start your free trial](https://report-uri.com/register/?plan=starter2025)