# Allowed origins and CSP

> List the sites that may load the widget, and let Iris through your Content Security Policy.

## Allowed origins

In **Settings → Widget → Allowed origins**, add each origin that loads the widget: the scheme, the host and the port, with no path. A request from any other origin fails with `403 origin_not_allowed`.

```text title="Allowed origins"
https://shop.example.com
https://*.shop.example.com
http://localhost:8080
app://breakdown-lab
```

- Use `https://`. Only a local test origin, such as `http://localhost:8080`, may use `http://`, and it needs a port.
- `https://*.shop.example.com` allows every subdomain of a domain you own.
- A desktop app uses a custom-scheme origin: its own scheme and name, such as `app://breakdown-lab`.

## Content Security Policy

If your site sends a Content Security Policy, add these sources to it. **Settings → Install** shows the same list.

```text title="Content-Security-Policy"
script-src https://cdn.irisdesk.app;
font-src https://cdn.irisdesk.app;
connect-src https://api.irisdesk.app wss://api.irisdesk.app https://190882e8060b31c81155a77d89a95891.r2.cloudflarestorage.com;
img-src https://api.irisdesk.app https://190882e8060b31c81155a77d89a95891.r2.cloudflarestorage.com;
media-src https://190882e8060b31c81155a77d89a95891.r2.cloudflarestorage.com;
```