# Get started with the Zoom Customer Experience SDK for web

<!-- WARNING: THIS FILE WAS AUTOGENERATED! DO NOT EDIT! -->

The Zoom Customer Experience SDK for web lets users engage with agents and chatbots directly without leaving your web application.

**Zoom Contact Center** supports:

-   Video engagement with live agents
-   Chat with live agents
-   Cobrowsing

**Zoom Virtual Agent** supports:

-   AI chatbot interactions
-   Optional escalation to live agents

## Requirements

To add the video or chat client, you must have:

-   Verified subdomain. See [Managing Zoom Contact Center verified domains](https://support.zoom.us/hc/en-us/articles/6985492329357) for details.
-   Video or chat flow configured to get embed code. See [Adding or duplicating a flow](https://support.zoom.us/hc/en-us/articles/4423986675085) for details.
-   Contact Center license and [entry ID](https://support.zoom.us/hc/en-us/articles/4470447059597) (used to start video or chat flow).
-   Content Security Policy header configured on your web server.

To add the chat client, you must have:

-   Published bot to get embed code.
-   Zoom Virtual Agent license.
-   Campaign or entry ID to start chat flow.
-   Content Security Policy header configured on your web server.

### Content Security Policy header

If you're using Content Security Policy (CSP) on your browsers and want to use any Zoom SDK for web, you must configure your web server to return the Content-Security-Policy header. For example, using the [Nginx `add_header` directive](https://nginx.org/en/docs/http/ngx_http_headers_module.html).

```plaintext
add_header 'Content-Security-Policy' "default-src 'self';base-uri 'self';worker-src blob:;style-src 'self' 'unsafe-inline';script-src 'self' 'unsafe-inline' 'unsafe-eval' https://zoom.us *.zoom.us dmogdx0jrul3u.cloudfront.net blob:;connect-src 'self' https://zoom.us https://*.zoom.us wss://*.zoom.us https://zoom.com https://*.zoom.com wss://*.zoom.com https://zoom.com.cn https://*.zoom.com.cn wss://*.zoom.com.cn;img-src 'self' https:;media-src 'self' https:;font-src 'self' https:;"
```

> **Warning**
>
> When `script-src-elem` is present in your CSP configuration, be sure its value matches the `script-src` directive.

For more on CSP, see the [Mozilla](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP), [web.dev](https://web.dev/csp/), or [W3C](https://www.w3.org/TR/CSP3/) documentation.

You'll need to add this if you see something like this error in the browser console.

```plaintext
CompileError: WebAssembly.instantiate(): Refused to compile or instantiate WebAssembly module because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'strict-dynamic' 'nonce-LxlpktY6Sou9E-ZC46OlZA' blob: https: 'unsafe-inline'"
at 3afbd0c1-54af-4f01-9d3f-8ffb8dcb31cf:1:22144
```

Note: If your browser supports it, you can use `wasm-unsafe-eval` instead of `unsafe-eval`. However, not all browsers support this. See the mdn web docs for [CSP: script-src: Unsafe WebAssembly execution](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src#unsafe_webassembly_execution) for details.

## PWA support

<span className="pill_media">Zoom Contact Center only</span>

Make sure that your web app supports PWA without impacting existing desktop support. To learn more, see [creating Contact Center apps](/docs/contact-center/apps/create-zcc-apps/).