Before you publish

Every site that shows the widget is an allowed site.
Your content security policy, if you have one, allows Centaur.
Your app calls destroy() when it removes the widget. See Widget recipes.
The Centaur attribution is visible. Do not crop or cover the widget.

Allowed sites

Live data loads only on pages whose origin matches an allowed site: the scheme and port must match, and the host must match exactly or through a wildcard. When the origin is not allowed, the widget ID does not exist or is not Live, or the partner account is not active, the feed shows “This feed is unavailable on this site.” and the positioning card shows “Current positioning is unavailable on this site.” Allowed sites control where the widget works, not who can see the data: the data and the widget ID are public.

You add	Matches	Does not match
`https://example.com`	`https://example.com`	`https://www.example.com`
`https://*.example.com`	`https://a.b.example.com`	`https://example.com`
`http://localhost:3000`	`http://localhost:3000`	`http://localhost:5173`

Plain HTTP works only for localhost, 127.0.0.1, and [::1], with a port.
Up to 20 sites per widget ID. Wildcards need a domain you own, so *.com and *.vercel.app are rejected.
Use a separate widget ID for local development, so you can turn it off on its own.

Content security policy

Skip this if your site sends no Content-Security-Policy header. Otherwise, add these hosts:

script-src   https://widgets.centaur.io
style-src    https://widgets.centaur.io
connect-src  https://api.centaur.io
img-src      https://widgets.centaur.io
             https://pbs.twimg.com
             https://abs.twimg.com
             https://s2.coinmarketcap.com
             https://centaur-asset-images-prod.s3.amazonaws.com
             https://centaur-asset-images-prod.s3.eu-west-1.amazonaws.com
             https://centaur-telegram-assets-prod.s3.eu-west-1.amazonaws.com

script-src also needs a nonce or hash for the inline mount script. To avoid one, move the mount call into your own script file and load it after the SDK.
The img-src hosts serve avatars and asset logos, and https://widgets.centaur.io serves the sample avatars. If they are blocked, the widget shows initials or a letter instead. Post photos can come from other hosts; add the ones you want to show.
Do not add an integrity hash to the SDK tag: /v1/sdk.js updates in place.

Get started

Embed widgets

Build with the API

Receive webhooks

Connect AI agents

Allowed sites

Content security policy

​Allowed sites

​Content security policy

Allowed sites

Content security policy