Home/Wiki Errors/ChatGPT Apps SDK
ChatGPT Apps SDK / Widget CSP

Apps SDK widget blocked by Content Security Policy

The ChatGPT widget iframe or asset request is blocked by CSP, frame, script, style, or connect-src policy.

Error text / 报错原文

  • Refused to frame
  • Content Security Policy
  • widget CSP blocked

What it means

The ChatGPT widget iframe or asset request is blocked by CSP, frame, script, style, or connect-src policy.

Most common causes

  • widgetDomain does not match hosted assets
  • connect-src misses API or MCP endpoint
  • Inline script blocked
  • Assets are hosted on a domain not declared in app metadata

Fastest fix

  • Reproduce the smallest failing case outside the agent.
  • Confirm auth, session, and transport before changing app code.
  • Disable unrelated tools or servers and retry once.
  • Capture the exact timestamp, client version, and raw error text.

Safe fix

  • Keep secrets in environment variables or the platform secret store.
  • Use least-privilege scopes and read-only tools by default.
  • Add validation around manifests, schemas, and callback URLs.
  • Document the working local and production configuration.

What not to do

  • Do not paste OAuth tokens or session IDs into public logs.
  • Do not bypass TLS, CSP, or permission prompts as a permanent fix.
  • Do not enable every MCP tool globally just to make one task pass.

Diagnostic commands

node --version
curl -I "$MCP_SERVER_URL"
echo "$OAUTH_CLIENT_ID"

Related tools

Related errors

Sources