Mollie

Mollie's CSP requirement is refreshingly short - three lines - and their documentation goes further than most by actively telling merchants to run a strict CSP on their checkout in the first place.

What Mollie requires

Mollie Components loads from a single domain:

script-src - js.mollie.com
frame-src - js.mollie.com
style-src - 'unsafe-inline'

That is the whole list. Because Components renders the card fields in an iframe served from Mollie's own origin, the card data never touches your page - which is also why the frame-src entry is not optional.

Sending reports to Report URI

Add a reporting directive to your policy. Your URL comes from the Setup page:

Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self' js.mollie.com; frame-src js.mollie.com; style-src 'self' 'unsafe-inline'; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly

Things to watch for

style-src 'unsafe-inline' is required for Components to style its fields. It is a genuine weakening of the policy, so keep it on style-src only - an 'unsafe-inline' that ends up applying to scripts undoes most of what the policy is for.
A short vendor list is not a short policy. Mollie is three lines; the rest of your checkout - analytics, chat widgets, tag managers - is where the reports will actually come from.
Mollie's own guidance is to run a strict CSP on checkout. Report-only first is how you get there without breaking a payment page.

Official documentation

Mollie - Mollie Components

Start Monitoring with Report URI

Already using us for CSP? Find your report-uri value on Setup, or view your CSP reports.

New to Report URI? Create an account and grab your report-uri value from the Setup page. Working towards PCI DSS 4.0? Start with our Compliance guides.

Start your free trial