Intercom

Intercom is one of the better-documented widgets for CSP: they support strict CSP Level 3 with nonces outright, and publish an allowlist as a fallback for policies that cannot use nonces.

What Intercom gives you

Full support for strict CSPv3. If you already serve a nonce-based policy of the shape Google recommends, Intercom states you do not need to change anything:
```
Content-Security-Policy: object-src 'none'; script-src 'nonce-{random}' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http:; base-uri 'self';
```
A source-allowlisting alternative if you cannot use CSP Level 2 or 3 features, with script-src entries for https://app.intercom.io, https://widget.intercom.io and https://js.intercomcdn.com.
Region-specific CDN domains, which only need adding for your workspace's own hosting region rather than all of them.

Sending reports to Report URI

Add a reporting directive to the policy you already serve. Your URL comes from the Setup page:

Content-Security-Policy-Report-Only: object-src 'none'; script-src 'nonce-{random}' 'strict-dynamic'; base-uri 'self'; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly

Things to watch for

The Messenger loads scripts of its own, so some of them need a nonce source. If you have gone the nonce route, check the Messenger actually renders rather than assuming a clean report means it did.
The regional CDN domains matter. Allowlisting the wrong region's domain looks correct in the policy and still blocks the widget.
Support widgets have a habit of being added by a marketing team rather than an engineering one, so they show up in CSP reports before anyone tells you they exist. That is a good argument for Script Watch alongside the policy.

Official documentation

Intercom - Using Intercom with Content Security Policy

Start Monitoring with Report URI

Already using us for CSP? Find your report-uri value on Setup, or view your CSP reports.

New to Report URI? Create an account and grab your report-uri value from the Setup page.

Start your free trial