Which CSP directives does Embed need?

Allow https://vinylletteringplugin.com in script-src, style-src, font-src, img-src and connect-src. Add blob: to worker-src, and data: and blob: to img-src. The designer uses inline styles, so style-src also needs 'unsafe-inline'.

The designer does not appear. What should I check?

Open the browser console. A CSP message names the blocked directive. Otherwise check that the domain is registered in the dashboard, that the licence is valid and that the shop id in the snippet is correct.

Embed: CSP and troubleshooting

Most sites need nothing special. If your site sends a Content-Security-Policy header, allow the entries below.

Strict Content-Security-Policy

Everything Embed loads comes from https://vinylletteringplugin.com. Allow that origin in:

Directive	Why
`script-src`	The loader (`loader.js`) and the designer script. The designer does not use `eval`.
`style-src`	The designer stylesheet. The designer and the order form also set inline styles, so `'unsafe-inline'` is needed as well (or `style-src-elem` and `style-src-attr` with it). A nonce-only setup is not supported.
`font-src`	The bundled fonts (woff2 and ttf).
`img-src`	Shapes and scene images, plus `data:` and `blob:` for previews and uploads.
`connect-src`	The Embed API (configuration, files and orders) and the designer data files.
`worker-src`	`blob:`, for the manufacturability check.

Example policy

Content-Security-Policy:
  script-src 'self' https://vinylletteringplugin.com;
  style-src 'self' 'unsafe-inline' https://vinylletteringplugin.com;
  font-src 'self' https://vinylletteringplugin.com;
  img-src 'self' data: blob: https://vinylletteringplugin.com;
  connect-src 'self' https://vinylletteringplugin.com;
  worker-src 'self' blob:;

Merge these entries into your existing policy instead of replacing it.

Workers

The designer checks whether lettering can be cut in a background worker created from a blob: URL. If worker-src does not allow blob:, the check runs on the main thread instead. The designer still works, but may feel slower with complex designs.

Troubleshooting

"Not available on this website": the domain is not registered for the shop, the licence has expired or is not valid, or the page runs inside a frame of a site builder so the domain differs. Check the dashboard.
"Temporarily unavailable": the service did not answer. Try again after a minute.
Nothing appears and there is no message: check that the page contains <div data-vst-designer></div> and that the script tag has a valid data-shop.
Two designers on a page: only the first is started.
Blocked by a CSP: the console names the directive. Add the matching entry from the table.
The order form does not open: the form uses the native dialog element. Update to a current browser.
Supported browsers: current Chrome, Edge, Firefox and Safari, on desktop and mobile.

Still stuck? Contact us with the page address and the console message.