Can I have example code please?
Topic summary
Third‑party API calls work on localhost but are blocked after deployment on Oxygen due to Content Security Policy (CSP) restrictions.
Key points:
- In Oxygen, developers must manage CSP headers themselves. The likely cause is the API’s domain not being allowed by the CSP, so the browser blocks requests.
- Resolution path 1: Update the site’s CSP header to include the third‑party API’s origin (e.g., in connect-src for fetch/XHR; possibly script-src if loading scripts).
- Resolution path 2 (recommended to avoid CSP changes): Move API calls from client‑side to server‑side (e.g., in actions or loaders), then return the needed data to the client.
Resources:
- An example Oxygen + Hydrogen setup is linked for guidance, though it doesn’t provide a direct CSP snippet.
Status:
- No final code sample provided in-thread; actionable options are identified, with a server‑side proxy approach as the latest suggestion.