Zero Permissions
Updated: Mar 3, 2026
Copy for LLM
Zero Permissions is a networking mode for Instant Games that allows your game to make network requests to external servers. By default, Instant Games run in a sandboxed environment that restricts outbound network access to Facebook-owned domains. Zero Permissions lifts this restriction, giving your game the ability to communicate with your own backend servers and third-party APIs.
This mode was formerly known as “Network Enabled Zero Permissions” (NEZP). If you see references to NEZP in older documentation or tooling, it refers to the same capability described here.
Why You Might Need Zero Permissions
Many Instant Games can be built entirely as client-side applications, using the Instant Games SDK for data persistence, social features, and monetization. However, some games require server-side capabilities that go beyond what the SDK provides. Zero Permissions enables these use cases.
Multiplayer and Real-Time Communication
If your game features real-time multiplayer gameplay — such as turn-based matches with live updates, cooperative play, or competitive PvP — you likely need a backend server to coordinate game state between players. Zero Permissions allows your game client to open WebSocket connections or make HTTP requests to your multiplayer server.
Server-Side Game Logic
For games that require authoritative server-side logic — such as anti-cheat validation, matchmaking, server-side economy management, or procedural content generation — Zero Permissions enables the game client to communicate with your backend services.
External APIs and Services
If your game integrates with third-party services — such as analytics platforms, custom leaderboard services, content delivery networks for dynamic assets, or machine learning APIs — Zero Permissions allows those outbound requests.
Custom Authentication and User Management
While the Instant Games SDK provides player identity through Facebook, some developers maintain their own user accounts or need to integrate with existing user management systems. Zero Permissions allows your game to authenticate with your own backend.
How Zero Permissions Works
When Zero Permissions is enabled for your app, the Instant Games runtime uses Content Security Policy (CSP) to control which external domains your game can use. You can configure trusted domains in the App Dashboard so your game can:
- Make HTTPS requests (via
fetch,XMLHttpRequest, or similar APIs) to your own servers or third-party APIs. - Use secure WebSocket connections for real-time communication.
- Load external resources such as scripts, images, or other assets from your own CDN.
Without Zero Permissions enabled, any attempt to make requests to non-Facebook domains will be blocked by the platform’s security policy, and you will see errors in the browser console.
Enabling Zero Permissions
To enable Zero Permissions for your Instant Game:
- Go to the App Dashboard and select your app.
- Navigate to Instant Games in the left sidebar.
- Under the settings or configuration section, find the Zero Permissions option.
- Toggle Zero Permissions to Enabled.
- Save your changes.
Once enabled, the change takes effect for all new game sessions. Players who are currently in a session may need to restart the game to pick up the updated configuration.
Requirements and Considerations
HTTPS Required
All external network requests from your game must use HTTPS. Plain HTTP connections are not supported and will be blocked. Ensure that your backend servers and any third-party APIs you integrate with support HTTPS.
Content Security Policy Configuration
If your game needs to communicate with external services or load assets from external domains, add those domains to the Content Security Policy configuration in the App Dashboard. For complete setup steps, see Content Security Policy.
The CSP configuration is shared across Instant Games owned by the same business portfolio. You need permission to manage Instant Games for the owning business to change this configuration.
Supported directives:
| Directive | Use this when your game needs to |
|---|---|
connect-src | Make network requests with fetch, XMLHttpRequest, WebSockets, or similar APIs. |
font-src | Load font files. |
frame-src | Load iframe content. |
img-src | Load images. |
media-src | Load audio or video. |
script-src | Load JavaScript. |
style-src | Load stylesheets. |
New domains must have valid SSL certificates before they can be added. Wildcard domains, scheme sources such as
data:, and CSP keywords such as 'unsafe-inline' are not accepted through the self-serve configuration UI.Some common domains may already be allowed by the platform. However, if your game depends on an external domain, add it to your CSP configuration so the dependency remains explicit and easier to maintain.
App Review
Games with Zero Permissions enabled are subject to the same review process as all Instant Games. However, reviewers may ask additional questions about how your game uses network access, particularly if your game communicates with servers that handle player data. Be prepared to explain the purpose of your external network requests.
Data Privacy and Compliance
When your game communicates with external servers, you are responsible for complying with all applicable data privacy laws and Facebook Platform policies. Specifically:
- Do not transmit Facebook user data (such as player IDs, names, or photos) to your servers without complying with the Facebook Platform Terms and applicable privacy regulations.
- Ensure that your server-side data handling practices are documented in your app’s privacy policy.
- If you store player data on your servers, implement appropriate security measures to protect that data.
Performance Considerations
Network requests to external servers introduce latency that is outside of Facebook’s control. Consider the following:
- Minimize blocking requests during loading. If your game needs to fetch data from your server at startup, do so in parallel with asset loading and report progress to the player using
FBInstant.setLoadingProgress(). - Handle network failures gracefully. Mobile players may have unreliable connections. Implement timeouts, retries, and offline fallbacks where appropriate.
- Use regional servers. Instant Games have a global audience. If you run your own backend, consider deploying servers in multiple regions to reduce latency for players worldwide.
Zero Permissions vs. Older Networking Restrictions
In earlier versions of the Instant Games platform, networking was either fully restricted (no external requests allowed) or required manual configuration to enable limited access. Zero Permissions and self-serve CSP configuration replace those older models with a dashboard-based flow: enable Zero Permissions, add the external domains your game depends on, and select the CSP directives your game needs for each domain.
If your game was previously configured with an older networking mode, we recommend migrating to Zero Permissions for the most straightforward and fully supported experience.
Migration Guides
If you are moving to Instant Games from another platform, the following guides walk you through the process:
- Migrating from Canvas Games — A step-by-step guide for developers moving from Legacy Web Games (Canvas) to Instant Games with Zero Permissions.
- Migrating from Facebook Login for Gaming — A guide for developers transitioning from Facebook Login for Gaming to the Zero Permissions model.
Next Steps
- Quick Start — If you are new to Instant Games, start here to build your first game.
- Unity Plugin — If you are building your game in Unity, use the Unity plugin for C# access to the full SDK including overlay views.
- Game Testing — Learn how to test your game on the platform, including testing network requests.
- Bundle Configuration — Configure your game bundle with
fbapp-config.json. - SDK Reference — Full API documentation for the Instant Games SDK.