> ## Documentation Index
> Fetch the complete documentation index at: https://docs.centaur.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Before you publish

> Check these before a live widget goes on a public page.

* [ ] Every site that shows the widget is an [allowed site](#allowed-sites).
* [ ] Your [content security policy](#content-security-policy), if you have one, allows Centaur.
* [ ] Your app calls `destroy()` when it removes the widget. See [Widget recipes](https://docs.centaur.io/integrations/widget-recipes).
* [ ] The Centaur attribution is visible. Do not crop or cover the widget.

## Allowed sites

Live data loads only on pages whose origin matches an allowed site: the scheme and port must match, and the host must match exactly or through a wildcard. When the origin is not allowed, the widget ID does not exist or is not Live, or the partner account is not active, the feed shows "This feed is unavailable on this site." and the positioning card shows "Current positioning is unavailable on this site." Allowed sites control where the widget works, not who can see the data: the data and the [widget ID](https://docs.centaur.io/guides/overview/authentication.md#widget-id) are public.

| You add | Matches | Does not match |
| - | - | - |
| `https://example.com` | `https://example.com` | `https://www.example.com` |
| `https://*.example.com` | `https://a.b.example.com` | `https://example.com` |
| `http://localhost:3000` | `http://localhost:3000` | `http://localhost:5173` |

* Plain HTTP works only for `localhost`, `127.0.0.1`, and `[::1]`, with a port.
* Up to 20 sites per widget ID. Wildcards need a domain you own, so `*.com` and `*.vercel.app` are rejected.
* Use a separate widget ID for local development, so you can turn it off on its own.

## Content security policy

Skip this if your site sends no `Content-Security-Policy` header. Otherwise, add these hosts:

```text theme={null}
script-src   https://widgets.centaur.io
style-src    https://widgets.centaur.io
connect-src  https://api.centaur.io
img-src      https://widgets.centaur.io
             https://pbs.twimg.com
             https://abs.twimg.com
             https://s2.coinmarketcap.com
             https://centaur-asset-images-prod.s3.amazonaws.com
             https://centaur-asset-images-prod.s3.eu-west-1.amazonaws.com
             https://centaur-telegram-assets-prod.s3.eu-west-1.amazonaws.com
```

* `script-src` also needs a nonce or hash for the inline mount script. To avoid one, move the mount call into your own script file and load it after the SDK.
* The `img-src` hosts serve avatars and asset logos, and `https://widgets.centaur.io` serves the sample avatars. If they are blocked, the widget shows initials or a letter instead. Post photos can come from other hosts; add the ones you want to show.
* Do not add an `integrity` hash to the SDK tag: `/v1/sdk.js` [updates in place](https://docs.centaur.io/integrations/widget-reference.md#runtime-behavior).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.