Widget CSP & Domain Warning

ChatGPT Apps SDK
1

Hello,

has everyone been able to get rid of the Widget CSP & Domain warning that you see at the bottom of apps created in Dev mode ?

I have actually set :

_meta: {
“openai/widgetDescription”: “The widget displays products matching the search query .”,
“openai/toolInvocation/invoking”: “Searching in catalog…”,
“openai/toolInvocation/invoked”: “Searched in catalog.”,
“openai/widgetDomain”: “``https://chatgpt.com``”,
“openai/widgetCSP”: {
connect_domains: “https://www.mydomain.com”,
resource_domains: “https://123123.cloudfront.net”,
},
},

To no avail…

Screenshot 2026-01-08 at 15.30.15
Screenshot 2026-01-08 at 15.30.152904×632 156 KB

2

Hi CharlesS

Try to use arrays for “connect_domains” and “resource_domains”

“openai/widgetCSP”: {
connect_domains: ["https://www.mydomain.com"],
resource_domains: ["https://123123.cloudfront.net"]
}

3

Also, remove the `` marks from the value of the widgetDomain.

“openai/widgetDomain”: “https://chatgpt.com”,

4

I managed to totally not copy & paste correctly my actual code which is actually:

"openai/widgetDomain": "https://chatgpt.com",

        "openai/widgetCSP": {

connect_domains: [env.MY_DOMAIN],

resource_domains: [env.MY_IMG_DOMAIN],

        },

      },

And in the inspector here is the meta object returned by my server so it seems in line with the openAI doc



{
“openai/widgetDescription”: “The widget displays products matching the search query in the catalog.”,
“openai/toolInvocation/invoking”: “Searching in catalog…”,
“openai/toolInvocation/invoked”: “Searched in catalog.”,
“openai/widgetDomain”: “``https://chatgpt.com``”,
“openai/widgetCSP”: {
“connect_domains”: [
“``https://www.mydomain.com``”
],
“resource_domains”: [
“``https://d10c1232.cloudfront.net``”
]
},
“openai/outputTemplate”: “ui://widgets/search.html”,
“ui/resourceUri”: “ui://widgets/search.html”
}

My question was really, did anyone manage to get rid of the warning ?

5

Not sure if you’re already doing this, but you should set the widget CSP in _meta, inside the contents returned by the registered template/widget, rather than in the tool definition.

See Step 1 – Register a component template: https://developers.openai.com/apps-sdk/build/mcp-server

1 Like