> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kinematic.run/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> These are the customer docs for kinematic, a name written in lowercase except at the start of a sentence. Kinematic provides provably fair casino games, served to a casino's site by a game server: a Cloudflare Worker that the kinematic dashboard deploys into the casino's own Cloudflare account.
> Never put SESSION_SECRET or WALLET_SECRET in code, prompts, logs, commits or chat. Read them from environment variables and ask the person you work with to set them. The dashboard's Integration page shows each secret once.
> Values such as lucky-star, luckystar.example, og-rgs-lucky-star.luckystar.workers.dev, games.luckystar.example and player_48213 are examples. Use the casino's own casino ID, game server origin, element tag, session issuer and currencies: the Instructions for your coding agent on the dashboard's Integration page hold them, or ask the person you work with.
> To debug, start at https://docs.kinematic.run/troubleshooting and https://docs.kinematic.run/reference/errors. The wallet contract is at https://docs.kinematic.run/api/wallet.openapi.yaml.
> Sandbox bets are recorded on Solana devnet. Live game servers record nothing on Solana until the audited mainnet program is deployed.

# Content Security Policy

> If your pages send a Content-Security-Policy, add these directives so they can load the games, check proofs in the browser and read Solana records.

If your pages send a `Content-Security-Policy` header, it must allow your game server. A page without a policy needs nothing on this page.

The games load as JavaScript modules from your game server, talk to it over https and WebSocket, fetch their sounds and 3D models from it, and load images and fonts from it. The Provably fair dialog recomputes outcomes with WebAssembly and asks a public Solana RPC for each bet's record.

## Directives

Merge these into your policy, with your game server's host in place of `og-rgs-lucky-star.luckystar.workers.dev`:

```http theme={null}
script-src 'self' https://og-rgs-lucky-star.luckystar.workers.dev 'wasm-unsafe-eval';
connect-src 'self' https://og-rgs-lucky-star.luckystar.workers.dev wss://og-rgs-lucky-star.luckystar.workers.dev https://api.devnet.solana.com https://api.mainnet-beta.solana.com;
img-src 'self' https://og-rgs-lucky-star.luckystar.workers.dev data:;
font-src 'self' https://og-rgs-lucky-star.luckystar.workers.dev;
style-src 'self' 'unsafe-inline';
```

The **Put the games on your page** step on **Integration** shows these directives with your game server's host filled in, under **Content Security Policy, for pages that send one**, below the code. With several game servers, they follow the one chosen in **Game server**. The instructions for your coding agent list them for every game server you have.

| Directive | Why the games need it |
| - | - |
| `script-src` your game server | The loader and the games are modules served by your game server. |
| `script-src 'wasm-unsafe-eval'` | The Provably fair dialog recomputes each outcome with the game engine compiled to WebAssembly. |
| `connect-src` your game server, `https` and `wss` | The catalog, the WebSocket the games play over, and the sounds and 3D models the games fetch. |
| `connect-src` the Solana RPCs | The Provably fair dialog checks each bet's Solana record through a public RPC: `api.devnet.solana.com` for sandbox records, and `api.mainnet-beta.solana.com` for live records once the audited mainnet program is deployed. Until then, live bets have no Solana record. |
| `img-src` your game server and `data:` | The games' images come from your game server. Keno marks picked numbers with an inline `data:` image, and `config.logo`, the logo your page may show, is a `data:` URL. |
| `font-src` your game server | The games load Geist and Geist Mono from your game server, unless your theme sets other fonts. |
| `style-src 'unsafe-inline'` | The element and the Provably fair dialog style themselves with `<style>` elements inside their own shadow roots. |

> [!NOTE]
>
> Browsers ignore `'unsafe-inline'` in a `style-src` that also lists a nonce or a hash, and the games then load without their styles. The pages that show the games need a `style-src` without a nonce or a hash. A policy with `default-src` and no `style-src` applies `default-src` to styles too: add `style-src` with `'unsafe-inline'`.

Your session endpoint is on your own origin, so `'self'` covers it. If it is on another origin, add that origin to `connect-src`.

## A complete example

A page on `https://www.luckystar.example` that shows the games from `https://og-rgs-lucky-star.luckystar.workers.dev`. Besides the directives above, it sets `default-src`, `object-src` and `base-uri` of its own:

```http theme={null}
Content-Security-Policy: default-src 'self'; script-src 'self' https://og-rgs-lucky-star.luckystar.workers.dev 'wasm-unsafe-eval'; connect-src 'self' https://og-rgs-lucky-star.luckystar.workers.dev wss://og-rgs-lucky-star.luckystar.workers.dev https://api.devnet.solana.com https://api.mainnet-beta.solana.com; img-src 'self' https://og-rgs-lucky-star.luckystar.workers.dev data:; font-src 'self' https://og-rgs-lucky-star.luckystar.workers.dev; style-src 'self' 'unsafe-inline'; object-src 'none'; base-uri 'self'
```

## When the policy blocks something

The browser's console names every refusal, for example `Refused to load the script 'https://og-rgs-lucky-star.luckystar.workers.dev/element/v1/loader.js' because it violates the following Content Security Policy directive`. [Troubleshooting](https://docs.kinematic.run/troubleshooting.md#the-browser-refuses-the-loader-or-the-connection) lists each refusal and its fix.

Your game server checks the page's origin separately from your policy: the origin must also be in **Allowed origins**, under **Players and sessions** in [Settings](https://docs.kinematic.run/dashboard/settings.md#players-and-sessions).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.