---
description: The Content Security Policy directives the PayPal JS SDK requires, including nonce support, and how to send CSP violation reports to Report URI.
---

# PayPal

PayPal publishes dedicated CSP guidance for the JavaScript SDK, and it is more accommodating than most payment integrations: the SDK supports a nonce directly, so you do not have to choose between a strict policy and a working PayPal button.

Integrating through Braintree rather than the JS SDK directly? See our [Braintree](/platforms/braintree/) page - the domain list is different.

## What PayPal requires

PayPal's guidance covers the same set of domains across several directives:

- `*.paypal.com`
- `*.paypalobjects.com`
- `*.venmo.com`

These are needed in `script-src`, `connect-src` and `frame-src`, with `child-src`, `img-src` and `style-src` covering the same origins depending on which parts of the SDK you use.

The SDK also accepts a nonce through a `data-csp-nonce` attribute on the script tag:

    <script src="https://www.paypal.com/sdk/js?client-id=test" data-csp-nonce="YOUR_NONCE"></script>

The value must match the nonce in your policy, and be regenerated for every response.

## Sending reports to Report URI

Add a reporting directive alongside the PayPal directives. Your URL comes from the [Setup](https://report-uri.com/account/setup/) page:

    Content-Security-Policy-Report-Only: script-src 'self' 'nonce-{random}' *.paypal.com *.paypalobjects.com; connect-src 'self' *.paypal.com; frame-src *.paypal.com; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly

## Things to watch for

- The Venmo domains are easy to miss because they are not obviously PayPal. If you offer Venmo as a funding source, `*.venmo.com` needs allowing or the button silently fails to render.
- Passing the nonce to your own scripts but not to the SDK script tag is the usual failure. `data-csp-nonce` is a separate attribute from the standard `nonce` attribute - set both if your framework only manages the latter.
- Payment pages are in scope for PCI DSS 6.4.3 and 11.6.1. Our [Compliance](/compliance/) guides cover what an assessor will expect to see.

## Official documentation

[PayPal - Content Security Policy](https://developer.paypal.com/sdk/js/csp/)

## Start Monitoring with Report URI

**Already using us for CSP?** Find your report-uri value on [Setup](https://report-uri.com/account/setup/), or view your [CSP reports](https://report-uri.com/account/reports/csp/).

**New to Report URI?** Create an account and grab your report-uri value from the [Setup](https://report-uri.com/account/setup/) page. Working towards PCI DSS 4.0? Start with our [Compliance](/compliance/) guides.

[Start your free trial](https://report-uri.com/register/?plan=starter2025)