---
description: How to run the Intercom Messenger under a Content Security Policy, and how to send CSP violation reports to Report URI.
---

# Intercom

Intercom is one of the better-documented widgets for CSP: they support strict CSP Level 3 with nonces outright, and publish an allowlist as a fallback for policies that cannot use nonces.

## What Intercom gives you

- Full support for strict CSPv3. If you already serve a nonce-based policy of the shape Google recommends, Intercom states you do not need to change anything:

        Content-Security-Policy: object-src 'none'; script-src 'nonce-{random}' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http:; base-uri 'self';

- A source-allowlisting alternative if you cannot use CSP Level 2 or 3 features, with `script-src` entries for `https://app.intercom.io`, `https://widget.intercom.io` and `https://js.intercomcdn.com`.
- Region-specific CDN domains, which only need adding for your workspace's own hosting region rather than all of them.

## Sending reports to Report URI

Add a reporting directive to the policy you already serve. Your URL comes from the [Setup](https://report-uri.com/account/setup/) page:

    Content-Security-Policy-Report-Only: object-src 'none'; script-src 'nonce-{random}' 'strict-dynamic'; base-uri 'self'; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly

## Things to watch for

- The Messenger loads scripts of its own, so some of them need a nonce source. If you have gone the nonce route, check the Messenger actually renders rather than assuming a clean report means it did.
- The regional CDN domains matter. Allowlisting the wrong region's domain looks correct in the policy and still blocks the widget.
- Support widgets have a habit of being added by a marketing team rather than an engineering one, so they show up in CSP reports before anyone tells you they exist. That is a good argument for [Script Watch](/setup/script-watch/) alongside the policy.

## Official documentation

[Intercom - Using Intercom with Content Security Policy](https://www.intercom.com/help/en/articles/3894-using-intercom-with-content-security-policy)

## Start Monitoring with Report URI

**Already using us for CSP?** Find your report-uri value on [Setup](https://report-uri.com/account/setup/), or view your [CSP reports](https://report-uri.com/account/reports/csp/).

**New to Report URI?** Create an account and grab your report-uri value from the [Setup](https://report-uri.com/account/setup/) page.

[Start your free trial](https://report-uri.com/register/?plan=starter2025)