---
page_title: CSP for iFrame Checkout
product: Hypercheckout
platform: Web
page_source: https://juspay.io/in/docs/hyper-checkout/web/resources/csp-for-iframe-checkout
llms_txt: https://juspay.io/in/docs/llms.txt
product_llms_txt: https://juspay.io/in/docs/hyper-checkout/llms.txt
---


# CSP Guidelines for iFrame Checkout




## Overview



Content Security Policy (CSP) is a browser security header that controls what resources a page is permitted to load or launch. The frame-src directive, specifically, governs what URL schemes an iFrame is allowed to navigate to.

If your website enforces a CSP header, you must explicitly add UPI intent schemes to the `frame-src` directive. Without this, the browser silently blocks UPI app launches and the payment fails — with no visible error shown to the customer.

UPI Intent is a deep-link-based flow. When a customer selects UPI on the checkout, the iFrame hands a deep link (e.g. phonepe:// or tez://) to the device. The installed PSP app registers these custom URL schemes and opens a pre-filled payment screen. No credentials or money pass through the iFrame — the browser acts only as the launcher.

> **Warning**
> If `frame-src` is absent, the browser falls back to `default-src`. 
> 
> A restrictive `default-src` will also block UPI schemes. Hence, always declare `frame-src` explicitly.




## UPI Intent Schemes



Add all of the following schemes to your `frame-src` directive. Omitting any single scheme blocks customers using that UPI app.


| Scheme | UPI App |
|---|---|
| upi: | Generic UPI intent (app selector) |
| paytmmp: | Paytm |
| phonepe: | PhonePe |
| amazonpay: | Amazon Pay |
| bhim: | BHIM |
| tez: | Google Pay |
| slice-upi: | Slice |
| tnupi: | Tata Neu UPI |
| mobikwik: | Mobikwik |
| jupiter: | Jupiter |
| postpe: | PostPe (BharatPe) |
| kiwi: | Kiwi |
| navipay: | Navi Pay |
| myairtel: | Airtel |
| super: | Super Money |
| credpay: | Cred Pay |
| yespay: | Yes Pay |
| popclubapp: | PopClub UPI |


**Sample Code Snippet** 

`frame-src 'self' https: upi: tez: phonepe: paytmmp: credpay: myairtel: bhim: navipay: mobikwik: kiwi: tnupi: popclubapp: super: postpe: slice-upi: amazonpay: jupiter: yespay: ;`

The 'self' and https: tokens preserve your existing frame-loading behaviour. The UPI schemes are additive — they only permit custom-scheme navigation on the device and do not weaken XSS protection or expose any web origin.


## **Verifying the configuration** 



After deploying the updated header, verify it using your browser's developer tools:

1. Open the checkout page in Chrome or any other browser.
2. Open DevTools → Network tab → reload the page.
3. Select the checkout page document request and inspect the Response Headers.
4. Confirm the content-security-policy header includes all UPI schemes under frame-src.
5. Test a UPI Intent payment on a real Android device. The UPI app must launch automatically without a browser prompt or silent failure.
6. Check the browser Console for any remaining Refused to frame or Content Security Policy violations and add any newly flagged schemes.

---

## See Also

- [Webview SDK](https://juspay.io/in/docs/hyper-checkout/web/resources/webview-sdk)
- [UPI Package Names](https://juspay.io/in/docs/hyper-checkout/web/resources/upi-package-names)