> For the complete documentation index, see [llms.txt](https://help.usejimo.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.usejimo.com/docs/getting-started/install-jimo/csp-and-identity-verification.md).

# CSP and identity verification

Two security topics that come up in most installs, and that your security team will ask about before the snippet goes to production.

***

## Content Security Policy

If your application sends a `Content-Security-Policy` header, the browser blocks every script, request and frame not on the allow-list. Jimo is one of them until you add it. The symptom is the same with the Chrome extension and with the snippet: nothing loads, and the console shows "Refused to load" or "blocked by Content Security Policy".

<figure><img src="https://2794860263-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FKzAcDWQbK1gKbpra7bkb%2Fuploads%2FlTNMJX5BxdYxQiFouMhu%2Fn20-csp-gate.png?alt=media&#x26;token=7ed115c8-b491-4062-aca9-5eceab748487" alt="Jimo requests pass the allow-list per directive, an unlisted one is blocked"><figcaption></figcaption></figure>

### What to allow

The current list of Jimo domains, per directive (`script-src`, `connect-src`, `img-src`, `frame-src`, `style-src`, `font-src`), is in [Settings > Installation](/docs/settings/installation.md), and the same list with an example policy per directive is in [Domain whitelisting](https://help.usejimo.com/docs/for-developers/for-developers/install-our-sdk#domain-whitelisting). Copy it from there rather than from a saved document, so you get the list that is current.

Two directives deserve a check with your security team:

#### `script-src`

`script-src` may need `'unsafe-eval'` for experiences to render. Whether `'unsafe-inline'` is also needed depends on how you load the snippet; a snippet loaded from a file or a tag manager does not need it.

#### `connect-src`

`connect-src` has to include the domains Jimo calls at runtime, not only the one that serves the script.

### How to check

Since September 2026, the [Troubleshoot](/docs/settings/troubleshooting.md) tool surfaces CSP violations when the snippet loads but resources are blocked. Before that point, the browser console is the only place they show: open it on your app, filter on "Content Security Policy".

## Identity verification

Without verification, anyone can open the console on your app and run an identify call with another user's ID. Verification makes Jimo reject any identifier your backend did not sign.

<figure><img src="https://2794860263-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FKzAcDWQbK1gKbpra7bkb%2Fuploads%2FJ2fJ0sA9bv5aDSEjKKNX%2Fn21-signed-identify.png?alt=media&#x26;token=960455c7-ecf9-4661-b7fc-6ae40288a82e" alt="Your server signs the user ID, the browser passes it, Jimo accepts it; an unsigned call is rejected"><figcaption></figcaption></figure>

### How it works

{% stepper %}
{% step %}

#### Enable it and copy the secret

In [Settings > Installation](/docs/settings/installation.md), Identification tab, enable **Identify Verification** and copy the secret key.
{% endstep %}

{% step %}

#### Sign the user ID on your server

On your server, sign the user ID with HMAC-SHA256: the signed value is the hex digest of `${id}-${now}`, then a hyphen, then `now` again, where `now` is the current Unix time in seconds, computed per signature.
{% endstep %}

{% step %}

#### Pass the signed identifier

Pass the signed identifier as the third argument of identify; the second stays `null`:

```javascript
window.jimo.push(['do', 'identify', [user.id, null, signedIdentifier]]);
```

{% endstep %}
{% endstepper %}

The secret never reaches the browser bundle, a client-side environment variable, or your repository. Keep it in the server environment and expose only the signed value for the authenticated session.

### Fail closed

Once verification is on, an unsigned identify is rejected for every user. If the secret is missing in an environment, do not identify at all: log a warning and leave Jimo inert. Identifying without a signature spends a MAU and returns nothing. The console error to look for is `IDENTIFY_VERIFICATION_SIGNATURE_SIGNIN_FAILED`.

Step by step with code samples: [Setup Identify Verification](https://help.usejimo.com/docs/for-developers/for-developers/sdk-guides/setup-identify-verification).

## Data and compliance

Where Jimo stores data, sub-processors, retention and the GDPR documentation are in the [Data and Legal](https://help.usejimo.com/docs/data-and-legal/) space.

## Related

* [Install Jimo](/docs/getting-started/install-jimo.md)
* [Install our SDK](https://help.usejimo.com/docs/for-developers/for-developers/install-our-sdk)
* [When the extension does not load](/docs/getting-started/install-the-chrome-extension/when-the-extension-does-not-load.md)