kopairDocumentation
Dashboard ↗
Documentation / Connect your site

CSP and first-party delivery

A downloaded script needs a working channel for configuration, analytics and Live editing.

Reviewed: 25.10.2026 · Based on current product behavior

Step by step

  1. In direct mode allow https://cdn.kopair.com in script-src, and https://cdn.kopair.com plus https://kopair.com in connect-src. Merge into existing directives; do not replace your whole policy.
  2. If your policy restricts inline styles, review the SDK style requirements with your developer. Script access alone is insufficient for visual changes.
  3. For first-party delivery use the complete Nginx route configuration shown in Install SDK, including agent, runtime, install, track and edit-session routes. Save that delivery mode in kopair and install the first-party tag.
  4. After switching modes, open the site again and obtain a new SDK signal.
Practical example

A self-hosted WordPress site can use Nginx first-party routes. On hosted Tilda, Shopify or Webflow you may not control the web server; use direct delivery where allowed instead of pasting Nginx configuration into an HTML field.

How to verify

Check browser Console for CSP errors and Network for blocked script/API calls. Without a working channel the SDK returns to Control; Sandbox access does not prove Live readiness.