CSP and domains to allow in your store

If your store uses a Content Security Policy (CSP), the policy must allow Provei’s addresses. Otherwise the browser blocks the script, the button doesn’t show, and the console logs policy violation warnings.

If the store doesn’t send the Content-Security-Policy header or the equivalent meta tag, there’s nothing to do.

What to allow

Directive	Value	What for
`script-src`	`https://app.provei.ai`	Load the try-on script and the Video Commerce script.
`connect-src`	`https://app.provei.ai`	Fetch the store settings, check the product on the page and record usage.
`frame-src`	`https://app.provei.ai`	Open the try-on window, which is an `iframe`.
`img-src`	`https://provei-ai.b-cdn.net` and `data:`	Show the store logo in the invitation pop-up and the enlarged result image.

Example, added to the addresses your store already uses:

script-src 'self' https://app.provei.ai 'nonce-valor-aleatorio';
connect-src 'self' https://app.provei.ai;
frame-src https://app.provei.ai;
img-src 'self' https://provei-ai.b-cdn.net data:;

Cart requests go to the store’s own address, which 'self' already covers. If the invitation pop-up shows the product photo and the photo doesn’t appear with the policy on, contact support to confirm the image address for your account.

Room try-on loader

The verified loader is an inline script. Besides https://app.provei.ai, the policy must authorize that script in one of these ways:

Nonce. Put the same nonce your server sends in the policy on each page into the <script data-provei-widget-loader ...> tag.
Hash. Compute the SHA-256 hash of the script’s contents and add it to the policy. If you copy the code from the dashboard again, recompute the hash.

If your policy uses 'strict-dynamic', also put the nonce on the <script src="https://app.provei.ai/..."> tags of the other try-ons. The scripts Provei loads from them are then accepted.

Styles

The try-on adds its own stylesheet to the page (a <style> element) and applies styles directly to the button and window elements. If your policy blocks styles written into the page, the button and the window show up unstyled or broken.

The policy has to allow the try-on’s styles. Use the most restrictive option your policy accepts, such as a nonce or a hash in style-src, where supported. If you’re not sure how to allow them, talk to support before publishing the policy.

Video Commerce

The Video Commerce script uses the same https://app.provei.ai addresses. It passes the tag’s nonce on to the script it loads. The videos come from dedicated video hosts: to find out which ones to allow in media-src and connect-src, contact support.

Google Tag Manager

If you install the Provei code through the store’s Google Tag Manager, the policy must already allow your GTM, as it does for the other tags GTM loads. The addresses on this page are still required.

Check after publishing

Open a catalog product page with the browser console open.
Look for security policy warnings that mention app.provei.ai or provei-ai.b-cdn.net.
Click the try-on button and check that the window opens with the right styling.

If a warning remains, send support the page link and the warning text: suporte@provei.ai or WhatsApp +55 11 5296-0168.

Frequently asked questions

My store has no CSP. Do I need to do anything?

No. This page only applies to stores that send the Content-Security-Policy header or the equivalent meta tag.

Can I allow everything on provei.ai with a wildcard?

We don't recommend it. Allow only the exact addresses on this page. Wildcards open the store to more origins than the try-on needs.

Provei support answers by email and WhatsApp.