Content Security Policy

Updated: Jul 10, 2026

Copy for LLM

Instant Games use Content Security Policy (CSP) to control which external domains your game can communicate with or load resources from. If your game uses external APIs, backend servers, CDNs, fonts, images, scripts, stylesheets, audio, video, or iframe content, configure those trusted domains in the App Dashboard.

Before you start

To configure CSP for an Instant Game:

Your app must be configured for Instant Games.

Your app must be associated with a business portfolio.

You must have permission to manage Instant Games for the owning business.

External domains must support HTTPS and have valid SSL certificates.

Configure trusted domains

Go to the App Dashboard and select your app.

Navigate to Instant Games.

Open the Content Security Policy tab.

Add each trusted domain without the https:// prefix and without a trailing slash. For example, enter api.example.com, not https://api.example.com/.

Select the CSP directives that match how your game uses that domain.

Save your changes.

Test your game and review the browser console for CSP errors.

The CSP configuration is shared across Instant Games owned by the same business portfolio. If another game or business admin under the same business has already added domains, those domains may already appear in the configuration.

Domain requirements

Each new domain must:

Be a concrete domain, such as api.example.com or cdn.example.com.

Omit the https:// prefix.

Omit trailing slashes and paths.

Use lowercase characters.

Have a valid SSL certificate.

Examples:

Valid	Invalid
`api.example.com`	`https://api.example.com`
`cdn.example.com`	`cdn.example.com/`
`assets.example.co.uk`	`*.example.com`
`fonts.example.com`	`data:`

Wildcard domains, scheme sources such as data:, and CSP keywords such as 'unsafe-inline' are not accepted through the self-serve configuration UI.

Supported directives

Select only the directives your game needs for each domain.

Directive	Use this when your game needs to
`connect-src`	Make network requests with `fetch`, `XMLHttpRequest`, WebSockets, or similar APIs.
`font-src`	Load font files.
`frame-src`	Load iframe content.
`img-src`	Load images.
`media-src`	Load audio or video.
`script-src`	Load JavaScript.
`style-src`	Load stylesheets.

Testing and troubleshooting

After you save your CSP configuration, start a new game session and test the flow that uses the external domain. If the browser console shows a CSP violation, check the violated directive and blocked domain, then update your configuration to include that domain for the matching directive.

Some common domains may already be allowed by the platform. However, if your game depends on an external domain, add it to your CSP configuration so the dependency remains explicit and easier to maintain. Some restricted runtime configurations may continue to enforce additional CSP restrictions, so test the game flow that uses each external domain before launch.

If the App Dashboard rejects a domain because SSL validation fails, confirm that the domain is publicly reachable over HTTPS and that the certificate is valid. If validation continues to fail for a valid domain, contact your Meta partner manager for review.

Next steps

Zero Permissions -- Learn how external networking works for Instant Games.

Game Testing -- Test your game before launch.

Game Performance -- Optimize loading, assets, and runtime performance.