---
description: How to run Twilio Segment's Analytics.js under a Content Security Policy, and how to send CSP violation reports to Report URI.
---

# Segment

Analytics.js loads from Segment's CDN, fetches your project's settings at runtime, and then loads whichever device-mode destinations you have enabled - each from its own domain. The last part is what makes CSP work here awkward, and Segment says as much: their support around CSP issues is limited precisely because so many integrations are involved.

## What Segment gives you

- `cdn.segment.com` for `analytics.min.js`, plus the settings path at `https://cdn.segment.com/v1/projects/<WRITE_KEY>/settings`.
- `api.segment.io` as the destination for outgoing event requests, needed in `connect-src`.
- Nonce support - modify the Segment snippet with a nonce matching the one in your policy.
- **Custom Domain**, a managed first-party subdomain over HTTPS, so event requests go through your own domain rather than segment.com.
- A self-managed custom proxy option, for full control over the origins involved.

## Sending reports to Report URI

Add a reporting directive to your policy. Your URL comes from the [Setup](https://report-uri.com/account/setup/) page:

    Content-Security-Policy-Report-Only: script-src 'self' cdn.segment.com; connect-src 'self' api.segment.io cdn.segment.com; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly

## Things to watch for

- Device-mode destinations load from their own domains, and the list is whatever is switched on in your Segment workspace. Enabling a destination in the UI changes what your pages load with no code change - the same delegation problem every tag manager has.
- Don't forget `connect-src` for the settings fetch as well as the script load. A policy that allows the script but not the settings request produces an analytics library that loads and then does nothing.
- Custom Domain or a self-managed proxy collapses the third-party origins into one you control, which makes the policy considerably simpler. If you are starting a CSP rollout and already use Segment heavily, it is worth doing that first.
- Segment's server-side libraries sidestep browser CSP entirely. If a destination doesn't need to run in the browser, that is the cleanest answer.

## Official documentation

[Twilio Segment - Analytics.js Frequently Asked Questions](https://www.twilio.com/docs/segment/connections/sources/catalog/libraries/website/javascript/faq)

## Start Monitoring with Report URI

**Already using us for CSP?** Find your report-uri value on [Setup](https://report-uri.com/account/setup/), or view your [CSP reports](https://report-uri.com/account/reports/csp/).

**New to Report URI?** Create an account and grab your report-uri value from the [Setup](https://report-uri.com/account/setup/) page.

[Start your free trial](https://report-uri.com/register/?plan=starter2025)