If your site has its own Content-Security-Policy (CSP), the voice widget needs the same permissions the web chat already requires (Manual 06), plus the call provider’s own origin:
- Allow the widget’s CDN in
script-src(the exact URL of the snippet you copied, section 2). - Allow the voice infrastructure’s origin in
connect-src(and, if your CSP explicitly requires it,media-src) — your provider confirms the exact URL if your CSP is restrictive. - The orb’s iframe needs microphone permission: if you embed the snippet inside another iframe of
your own (uncommon), make sure that iframe declares
allow="microphone"— the widget’s own snippet already does this for you in the normal case (pasted directly into your site).
The rest of the technical behavior (origin isolation, attestation, and the visitor’s browser NEVER receiving internal session credentials) is the same security model the chat widget already uses — nothing extra to configure beyond the CSP above.