All Collections
Getting Started
Web Push Integration
How can I include web push with my Content Security Policy rules?
How can I include web push with my Content Security Policy rules?

Depending on your environment, you may need to configure your website to authorize Batch.

Lucie avatar
Written by Lucie
Updated over a week ago

If you use a Content Security Policy (CSP) that involves "worker-src"/"connect-src"/"script-src" rules (or if you plan to set up one), some configuration is required for web push to work on your website.

Service Worker

Batch requires a Service Worker to be installed to handle push notifications.

The minimal CSP directive is:

worker-src 'self'


  • 'self' matches your website's origin, as this is where the Service Worker is hosted

  • is where the SDK is hosted, which will be loaded from the snippet we ask you to host on your website when setting up the Service Worker

JavaScript tag

Here are the minimum directives that you need to add to your CSP to authorize Batch JavaScript tag:

  1. connect-src

    Why: connect-src needs two domains as the SDK will use the Fetch API to download a file hosted on and then communicate with our backend services, which are on

  2. script-src 

    Why: script-src needs to be as this is where the SDK and its modules are hosted.

If you configure Batch using a script tag, you may also need to allow those:

script-src 'unsafe-inline'

We recommend that you use a nonce instead, as unsafe inline mostly defeats the CSP's purpose. You can find more info on the MDN CSP documentation.

Note: As all websites are different, you will need to configure your CSP further in order to adapt the above recommendations to your environment. We recommend that you first use the “report only” mode for testing purposes and remove it once you're confident that your CSP works in all browsers.

This article belongs to Batch's FAQ. Need more help? Find insightful articles, documentation, case & market studies, guides, and even more in our website's Resources section on and our blog.

Did this answer your question?