Intercom Messenger
Checked against the official docs on 2026-10-28. Official documentation (opens in a new tab)
Check Intercom Messenger against my policy
This entry covers US-hosted workspaces. EU and Australian workspaces use regional domains (e.g. api-iam.eu.intercom.io, uploads.intercomcdn.eu): see the official article.
The safer option: nonces
Intercom supports strict nonce-based CSP Level 3 policies. If your site already uses one, no change is needed apart from nonces on the scripts the Messenger loads.
Messenger (US workspace)
script-src https://app.intercom.io https://widget.intercom.io https://js.intercomcdn.com;
connect-src https://via.intercom.io https://api.intercom.io https://api-iam.intercom.io https://api-ping.intercom.io https://*.intercom-messenger.com wss://*.intercom-messenger.com https://nexus-websocket-a.intercom.io wss://nexus-websocket-a.intercom.io https://nexus-websocket-b.intercom.io wss://nexus-websocket-b.intercom.io https://uploads.intercomcdn.com https://uploads.intercomusercontent.com;
frame-src https://intercom-sheets.com https://www.intercom-reporting.com https://www.youtube.com https://player.vimeo.com https://fast.wistia.net;
font-src https://js.intercomcdn.com https://fonts.intercomcdn.com;
form-action https://intercom.help https://api-iam.intercom.io;
media-src https://js.intercomcdn.com https://downloads.intercomcdn.com;
img-src blob: data: https://js.intercomcdn.com https://static.intercomassets.com https://downloads.intercomcdn.com https://uploads.intercomusercontent.com https://gifs.intercomcdn.com https://video-messages.intercomcdn.com https://messenger-apps.intercom.io https://*.intercom-attachments-1.com;
style-src 'unsafe-inline';| Content | Allowed source | Why |
|---|---|---|
| Scripts | https://app.intercom.iohttps://widget.intercom.iohttps://js.intercomcdn.com | Loads the Messenger. |
| Data connections | https://via.intercom.iohttps://api.intercom.iohttps://api-iam.intercom.iohttps://api-ping.intercom.iohttps://*.intercom-messenger.comwss://*.intercom-messenger.comhttps://nexus-websocket-a.intercom.iowss://nexus-websocket-a.intercom.iohttps://nexus-websocket-b.intercom.iowss://nexus-websocket-b.intercom.iohttps://uploads.intercomcdn.comhttps://uploads.intercomusercontent.com | Real-time conversations and uploads. |
| Embedded frames | https://intercom-sheets.comhttps://www.intercom-reporting.comhttps://www.youtube.comhttps://player.vimeo.comhttps://fast.wistia.net | Embedded sheets and videos (Intercom documents these under child-src). |
| Fonts | https://js.intercomcdn.comhttps://fonts.intercomcdn.com | Messenger fonts. |
| Form submissions | https://intercom.helphttps://api-iam.intercom.io | Forms inside the Messenger. |
| Audio & video | https://js.intercomcdn.comhttps://downloads.intercomcdn.com | Sounds and media. |
| Images | blob:data:https://js.intercomcdn.comhttps://static.intercomassets.comhttps://downloads.intercomcdn.comhttps://uploads.intercomusercontent.comhttps://gifs.intercomcdn.comhttps://video-messages.intercomcdn.comhttps://messenger-apps.intercom.iohttps://*.intercom-attachments-1.com | Avatars, attachments and GIFs. |
| Inline styles | 'unsafe-inline' | The Messenger injects its styles. |
Something changed? Report an outdated entry (opens in a new tab).