> ## Documentation Index
> Fetch the complete documentation index at: https://verifyngo.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Automatic CSP

verifyngo can emit Content-Security-Policy headers in two different places, depending on the response type:

* **Challenge pages** (`cap.use_nonce = true`): every challenge render gets a fresh per-request nonce, applied to the page's inline scripts/styles and exposed to Cap's widget via `window.CAP_CSS_NONCE` / `window.CAP_SCRIPT_NONCE`. A `Content-Security-Policy` header is emitted (`script-src 'nonce-…' 'strict-dynamic' 'wasm-unsafe-eval'`, plus `style-`/`img-`/`font-`/`connect-src` allowlists derived from `cap.api_url`, `cap.verify_url`, `cap.widget_script_url`, and the `branding.*` URLs). Override it entirely with `cap.csp`, using `{nonce}` as a placeholder for the per-request nonce.
* **Proxied responses** (`response_csp`): a static policy applied to every upstream response, *unless the upstream already sent its own `Content-Security-Policy`*. It can't use nonces (verifyngo can't inject them into HTML it doesn't own), so include `'unsafe-inline'`/`'unsafe-eval'` as your app requires.