Eventyvo Connect

CSP, iframes & CORS

Allow Eventyvo embeds safely on third-party sites.

Why this matters

Embeds use a script from docs.eventyvo.com and an iframe to the same origin. Strict Content-Security-Policy (CSP) or X-Frame options on your site can block them.

Recommended CSP additions (your site)

Adjust to your policy style (Content-Security-Policy header or meta):

Content-Security-Policy:
  script-src 'self' https://docs.eventyvo.com;
  frame-src 'self' https://docs.eventyvo.com;
  img-src 'self' https: data:;
  connect-src 'self';
  • script-src — allow the embed loader
  • frame-src (or child-src) — allow embed iframes
  • You do not need to allow api.eventyvo.com in the browser for standard embeds

iframe embedding Eventyvo pages

If you iframe a subwebsite page hosted on Eventyvo / your custom domain, ensure that host allows framing for your parent origin if you control frame-ancestors. Connect widget routes on docs.eventyvo.com are designed to be framed.

CORS

Browser CORS to Connect REST with X-API-KEY is not supported for marketing sites. Call REST from your server (or Zapier/Make). Embeds avoid CORS by loading HTML in an iframe from docs.

Cookies

Registration CTA opens Eventyvo in a new tab, so third-party cookie restrictions rarely affect the CTA itself. Full registration happens on Eventyvo’s origin.

Checklist

  1. Script URL is https://docs.eventyvo.com/embed/v1/eventyvo-embed.js
  2. CSP allows that script + frames
  3. Ad blockers / privacy extensions can still block third-party frames — test in a clean profile
  4. Mixed content: your page must be HTTPS if embeds are HTTPS