diff --git a/CHANGELOG.md b/CHANGELOG.md
index b7d744c..5528c24 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,14 @@
 # Changelog
 
+## [0.3.4] - 2026-08-07
+### Added
+- `CspPolicy` — builds the Content-Security-Policy directives the host page needs (`script-src`, `connect-src`, `style-src`, `img-src`, `frame-src`); exposes `getDirectives()`, `getHeaderName()`, `getHeaderValue()` and `getMetaTag()`. Only the CDN origin comes from the loader URL; the API and application origins are taken from the environment or from the `apiUrl` / `applicationUrl` arguments, and an unknown origin throws a `CspException` instead of producing a guessed policy that would silently block the widget
+- `OriginAwareEnvironmentInterface` — extends `EnvironmentInterface` with `getApiUrl()` and `getApplicationUrl()`. Implemented by `Environment` (real values per case) and by `CustomEnvironment`, which accepts both as optional constructor arguments. Existing `EnvironmentInterface` implementations are unaffected
+- `SnippetClient::csp()` — policy pre-filled with the client's environment and nonce
+- `nonce` parameter on `SnippetClient`, `SnippetClientFactory::create()` and `SnippetCode` — `getHTML()` renders `<script nonce="…">`, so integrators no longer need `'unsafe-inline'`. The nonce is validated against the base64 alphabet and propagates into `script-src`
+- `CspException` for an invalid nonce or an origin that is neither known nor given
+- CSP section in the README and a runnable `examples/csp.php`
+
 ## [0.3.1] - 2026-04-17
 ### Changed
 - Add theme support to ConfOptions
diff --git a/README.md b/README.md
index fa3f12c..c3d7baf 100644
--- a/README.md
+++ b/README.md
@@ -102,6 +102,89 @@ class MyEnv implements EnvironmentInterface {
 
 $client = new SnippetClient('key', 'secret', new MyEnv());
 ```
+## Content Security Policy
+If your page sends a `Content-Security-Policy`, it has to allow the sources the widget uses. For **production** these are:
+```
+script-src  https://cdn.stromcom.cz
+connect-src https://www.stromcom.cz
+style-src   https://cdn.stromcom.cz
+img-src     data:
+frame-src   https://app.stromcom.cz
+```
+| Directive | Why |
+|---|---|
+| `script-src` | The loader and the widget bundle are served from the CDN. |
+| `connect-src` | The widget polls the notification API on the STROMCOM site. |
+| `style-src` | The widget stylesheets are served from the CDN. |
+| `img-src` | Built-in icons (e.g. the loading spinner) are inlined as `data:` URIs. |
+| `frame-src` | The chat itself runs in an iframe on the application origin. |
+
+**Avatars, attachments, fonts and media do not need any directive on your page** — they are loaded *inside* the iframe and are therefore covered by the policy of the application origin, not by yours.
+
+`'unsafe-inline'` is not needed either — see [Nonce for inline scripts](#nonce-for-inline-scripts) below for the `<script>` tags this library generates.
+
+### `CspPolicy`
+Instead of copying the list around, let the library build it for the environment you use:
+```php
+use Stromcom\Snippet\CspPolicy;
+use Stromcom\Snippet\Environment\Environment;
+
+$policy = new CspPolicy(Environment::PRODUCTION);
+
+header($policy->getHeaderName() . ': ' . $policy->getHeaderValue());
+// Content-Security-Policy: script-src https://cdn.stromcom.cz; connect-src https://www.stromcom.cz; …
+
+echo $policy->getMetaTag();
+// <meta http-equiv="Content-Security-Policy" content="script-src https://cdn.stromcom.cz; …">
+```
+`getDirectives()` returns `directive => list of sources`, so you can merge STROMCOM into a policy you already have:
+```php
+$ownPolicy = ['default-src' => ["'self'"], 'script-src' => ["'self'"]];
+
+foreach ($policy->getDirectives() as $directive => $sources) {
+    $ownPolicy[$directive] = [...$ownPolicy[$directive] ?? [], ...$sources];
+}
+```
+`Environment::PRODUCTION` and `Environment::STAGING` know all their origins, so nothing else is needed for them. For a `CustomEnvironment` the API and application origins are **not** guessed from the loader URL — they are separate hosts, and a wrong guess would silently produce a policy that blocks the widget. Give them to the environment:
+```php
+$environment = new CustomEnvironment(
+    'https://cdn.example.com/loader.js',
+    'https://example.com',       // API — the origin the widget polls
+    'https://chat.example.com',  // application — the origin of the iframe
+);
+
+$policy = new CspPolicy($environment);
+```
+…or straight to the policy, which also overrides what the environment says:
+```php
+$policy = new CspPolicy($environment, apiUrl: 'https://example.com', applicationUrl: 'https://chat.example.com');
+```
+If neither provides them, `CspPolicy` throws a `CspException` naming the directive it could not build and the argument to pass.
+
+> **Writing your own `EnvironmentInterface`?** `CspPolicy` reads the two origins from `OriginAwareEnvironmentInterface`, which extends `EnvironmentInterface` with `getApiUrl()` and `getApplicationUrl()` (both may return `null` when unknown). Either implement it as well, or pass `apiUrl` / `applicationUrl` to `CspPolicy`. Implementations of plain `EnvironmentInterface` keep working everywhere else — the extra interface only matters for CSP.
+
+### Nonce for inline scripts
+`getHTML()` emits an inline `<script>` tag. Rather than allowing `'unsafe-inline'`, pass the nonce of the current response — it is set **once** and applied to every tag the client generates:
+```php
+$nonce = base64_encode(random_bytes(16));  // a new value for every response
+
+$client = SnippetClientFactory::create(
+    clientKey:    'key',
+    clientSecret: 'secret',
+    nonce:        $nonce,
+);
+
+// The same nonce ends up in script-src
+header($client->csp()->getHeaderName() . ': ' . $client->csp()->getHeaderValue());
+// … script-src https://cdn.stromcom.cz 'nonce-4mB1r0EYA0lZ2Kk1J7bWpQ=='; …
+
+echo $client->snippet()->getHTML();
+// <script nonce="4mB1r0EYA0lZ2Kk1J7bWpQ==">…</script>
+```
+The nonce must be a non-empty base64 value (`[A-Za-z0-9+/=_-]`); anything else throws a `CspException`. `getCode()` is unaffected — it still returns the raw JavaScript. Without a nonce the output is unchanged, so upgrading changes nothing for existing integrations.
+
+A runnable version of these examples is in [`examples/csp.php`](examples/csp.php).
+
 ## Code hashing
 User and thread `code` values should be hard to guess. Instead of hashing IDs manually, enable automatic hashing and every `user()` / `thread()` call will HMAC-hash the code for you.
 
@@ -175,7 +258,7 @@ $client = new SnippetClient('key', 'secret', codeHasher: new MyCustomHasher());
 | `home(string $selector)` | Embeds the notification center into a DOM element. |
 All methods return a `SnippetCode` object with:
 - `->getCode()` — raw JavaScript string
-- `->getHTML()` — wrapped in `<script>…</script>`
+- `->getHTML()` — wrapped in `<script>…</script>` (with a `nonce` attribute when a nonce is configured)
 ## Options reference
 ### `UserOptions`
 | Parameter | Type | Required | Description |
diff --git a/examples/csp.php b/examples/csp.php
new file mode 100644
index 0000000..89f2394
--- /dev/null
+++ b/examples/csp.php
@@ -0,0 +1,78 @@
+<?php
+declare(strict_types=1);
+
+require_once __DIR__ . '/../vendor/autoload.php';
+
+use Stromcom\Snippet\CspPolicy;
+use Stromcom\Snippet\Environment\CustomEnvironment;
+use Stromcom\Snippet\Environment\Environment;
+use Stromcom\Snippet\Exception\CspException;
+use Stromcom\Snippet\SnippetClientFactory;
+
+// A fresh nonce must be generated for every single response.
+$nonce = base64_encode(random_bytes(16));
+
+$client = SnippetClientFactory::create(
+    clientKey:    'your-client-key',
+    clientSecret: 'your-bearer-token',
+    nonce:        $nonce,  // rendered as <script nonce="…"> on every generated tag
+);
+
+
+/** 1. Send the policy as a header */
+// $client->csp() reuses the client's environment and nonce.
+$policy = $client->csp();
+
+// header($policy->getHeaderName() . ': ' . $policy->getHeaderValue());
+echo $policy->getHeaderName() . ': ' . $policy->getHeaderValue() . "\n\n";
+
+
+/** 2. …or render it as a <meta> tag */
+echo $policy->getMetaTag() . "\n\n";
+
+
+/** 3. Merge the directives into an existing policy */
+// getDirectives() returns "directive => list of sources", so you can append the
+// STROMCOM sources to whatever your application already allows.
+$ownPolicy = [
+    'default-src' => ["'self'"],
+    'script-src'  => ["'self'"],
+    'connect-src' => ["'self'"],
+];
+
+foreach ($policy->getDirectives() as $directive => $sources) {
+    $ownPolicy[$directive] = array_values(array_unique([...$ownPolicy[$directive] ?? [], ...$sources]));
+}
+
+foreach ($ownPolicy as $directive => $sources) {
+    echo $directive . ' ' . implode(' ', $sources) . ";\n";
+}
+echo "\n";
+
+
+/** 4. The snippet carries the nonce */
+echo $client->snippet()->getHTML() . "\n\n";
+
+
+/** 5. A policy without a client */
+// Useful when the policy is built somewhere else than the snippet (middleware, edge config…).
+echo (new CspPolicy(Environment::STAGING))->getHeaderValue() . "\n\n";
+
+
+/** 6. A custom environment has to state its origins */
+// Only the CDN origin can be read from the loader URL; the API and the application run on
+// separate hosts, so they are never guessed from it.
+$environment = new CustomEnvironment(
+    'https://cdn.example.com/loader.js',
+    'https://example.com',       // API — the origin the widget polls
+    'https://chat.example.com',  // application — the origin of the iframe
+);
+
+echo (new CspPolicy($environment))->getHeaderValue() . "\n\n";
+
+// Without them the policy fails loudly instead of silently blocking the widget at runtime.
+try {
+    new CspPolicy(new CustomEnvironment('https://cdn.example.com/loader.js'));
+} catch (CspException $Exception) {
+    echo $Exception->getMessage() . "\n";
+}
diff --git a/src/CspPolicy.php b/src/CspPolicy.php
new file mode 100644
index 0000000..4d08015
--- /dev/null
+++ b/src/CspPolicy.php
@@ -0,0 +1,181 @@
+<?php
+declare(strict_types=1);
+
+namespace Stromcom\Snippet;
+
+use Stromcom\Snippet\Environment\Environment;
+use Stromcom\Snippet\Environment\EnvironmentInterface;
+use Stromcom\Snippet\Environment\OriginAwareEnvironmentInterface;
+use Stromcom\Snippet\Exception\CspException;
+use Stromcom\Snippet\Exception\EnvironmentException;
+use Stromcom\Snippet\Internal\NonceValidator;
+
+/**
+ * Content-Security-Policy directives the host page must allow for the widget to work.
+ *
+ * What the widget touches on the host page:
+ *   - loads the loader and the widget bundle from the CDN origin (`script-src`)
+ *   - loads the widget stylesheets from the same CDN origin (`style-src`)
+ *   - polls the notification API on the site origin (`connect-src`)
+ *   - renders inline SVG icons embedded as `data:` URIs (`img-src`)
+ *   - embeds the application in an iframe (`frame-src`)
+ *
+ * Avatars, attachments, fonts and media are loaded inside that iframe and are therefore
+ * governed by the policy of the application origin, not by the policy of the host page.
+ *
+ * ```php
+ * $policy = new CspPolicy(Environment::PRODUCTION, $nonce);
+ * header($policy->getHeaderName() . ': ' . $policy->getHeaderValue());
+ * ```
+ *
+ * The CDN origin comes from the loader URL, which contains it. The API and application
+ * origins are separate hosts and are never guessed — they are read from an
+ * {@see OriginAwareEnvironmentInterface} or passed as `$apiUrl` / `$applicationUrl`.
+ * When neither provides them, a {@see CspException} is thrown rather than a policy that
+ * silently blocks the widget.
+ */
+class CspPolicy {
+
+  public const HEADER_NAME = 'Content-Security-Policy';
+
+  public const DIRECTIVE_SCRIPT_SRC  = 'script-src';
+  public const DIRECTIVE_CONNECT_SRC = 'connect-src';
+  public const DIRECTIVE_STYLE_SRC   = 'style-src';
+  public const DIRECTIVE_IMG_SRC     = 'img-src';
+  public const DIRECTIVE_FRAME_SRC   = 'frame-src';
+
+  private const SOURCE_DATA_URI = 'data:';
+
+  private string $cdnOrigin;
+  private string $apiOrigin;
+  private string $applicationOrigin;
+  private ?string $nonce;
+
+  /**
+   * @param EnvironmentInterface $environment    Target environment (default: production)
+   * @param string|null          $nonce          CSP nonce of the page; when set it is added to `script-src`
+   * @param string|null          $apiUrl         API origin; required unless the environment provides it
+   * @param string|null          $applicationUrl Application (iframe) origin; required unless the environment provides it
+   *
+   * @throws CspException         when the nonce is invalid or an origin is neither known nor given
+   * @throws EnvironmentException when an URL cannot be reduced to an origin
+   */
+  public function __construct(
+    EnvironmentInterface $environment = Environment::PRODUCTION,
+    ?string $nonce = null,
+    ?string $apiUrl = null,
+    ?string $applicationUrl = null,
+  ) {
+    $this->cdnOrigin = self::toOrigin($environment->getLoaderUrl());
+
+    $this->apiOrigin = self::toOrigin(self::resolveUrl(
+      $apiUrl ?? self::apiUrlOf($environment),
+      $environment,
+      'apiUrl',
+      self::DIRECTIVE_CONNECT_SRC,
+    ));
+
+    $this->applicationOrigin = self::toOrigin(self::resolveUrl(
+      $applicationUrl ?? self::applicationUrlOf($environment),
+      $environment,
+      'applicationUrl',
+      self::DIRECTIVE_FRAME_SRC,
+    ));
+
+    $this->nonce = NonceValidator::validate($nonce);
+  }
+
+  /**
+   * Directive name => list of sources, so the integrator can merge them into an existing policy.
+   *
+   * @return array<string, list<string>>
+   */
+  public function getDirectives(): array {
+    $scriptSources = [$this->cdnOrigin];
+
+    if ($this->nonce !== null) {
+      $scriptSources[] = "'nonce-{$this->nonce}'";
+    }
+
+    return [
+      self::DIRECTIVE_SCRIPT_SRC  => $scriptSources,
+      self::DIRECTIVE_CONNECT_SRC => [$this->apiOrigin],
+      self::DIRECTIVE_STYLE_SRC   => [$this->cdnOrigin],
+      self::DIRECTIVE_IMG_SRC     => [self::SOURCE_DATA_URI],
+      self::DIRECTIVE_FRAME_SRC   => [$this->applicationOrigin],
+    ];
+  }
+
+  public function getHeaderName(): string {
+    return self::HEADER_NAME;
+  }
+
+  public function getHeaderValue(): string {
+    $directives = [];
+
+    foreach ($this->getDirectives() as $directive => $sources) {
+      $directives[] = $directive . ' ' . implode(' ', $sources);
+    }
+
+    return implode('; ', $directives);
+  }
+
+  public function getMetaTag(): string {
+    return sprintf(
+      '<meta http-equiv="%s" content="%s">',
+      self::HEADER_NAME,
+      htmlspecialchars($this->getHeaderValue(), ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8'),
+    );
+  }
+
+  public function getNonce(): ?string {
+    return $this->nonce;
+  }
+
+  private static function apiUrlOf(EnvironmentInterface $environment): ?string {
+    return $environment instanceof OriginAwareEnvironmentInterface ? $environment->getApiUrl() : null;
+  }
+
+  private static function applicationUrlOf(EnvironmentInterface $environment): ?string {
+    return $environment instanceof OriginAwareEnvironmentInterface ? $environment->getApplicationUrl() : null;
+  }
+
+  /**
+   * @throws CspException
+   */
+  private static function resolveUrl(?string $url, EnvironmentInterface $environment, string $parameterName, string $directive): string {
+    if ($url !== null) {
+      return $url;
+    }
+
+    throw new CspException(sprintf(
+      'Cannot build the "%s" directive: environment %s does not provide the URL. '
+      . 'Pass it as the "%s" argument of %s, or make the environment implement %s. '
+      . 'The origin is deliberately not guessed from the loader URL — a wrong guess would silently block the widget.',
+      $directive,
+      get_debug_type($environment),
+      $parameterName,
+      self::class,
+      OriginAwareEnvironmentInterface::class,
+    ));
+  }
+
+  /**
+   * @throws EnvironmentException
+   */
+  private static function toOrigin(string $url): string {
+    $parsed = parse_url($url);
+
+    if ($parsed === false || ($parsed['scheme'] ?? '') === '' || ($parsed['host'] ?? '') === '') {
+      throw new EnvironmentException(sprintf(
+        'Cannot derive a CSP source from "%s". An absolute URL including scheme and host is required.',
+        $url,
+      ));
+    }
+
+    $origin = "{$parsed['scheme']}://{$parsed['host']}";
+
+    return isset($parsed['port']) ? "{$origin}:{$parsed['port']}" : $origin;
+  }
+
+}
diff --git a/src/Environment/CustomEnvironment.php b/src/Environment/CustomEnvironment.php
index 1459a4a..7823f0f 100644
--- a/src/Environment/CustomEnvironment.php
+++ b/src/Environment/CustomEnvironment.php
@@ -9,14 +9,35 @@
  * Example:
  *   new CustomEnvironment('http://localhost:8082/loader.js')
  *   new CustomEnvironment('https://cdn.your-custom-domain.com/loader.js')
+ *
+ * The API and application origins are only needed to build a {@see \Stromcom\Snippet\CspPolicy};
+ * pass them when you want the policy to be generated for this environment:
+ *   new CustomEnvironment('https://cdn.example.com/loader.js', 'https://example.com', 'https://chat.example.com')
  */
-class CustomEnvironment implements EnvironmentInterface {
+class CustomEnvironment implements OriginAwareEnvironmentInterface {
 
-  public function __construct(private string $loaderUrl) {
+  /**
+   * @param string      $loaderUrl      URL of the loader script
+   * @param string|null $apiUrl         Origin the widget polls for notifications
+   * @param string|null $applicationUrl Origin the widget iframe is embedded from
+   */
+  public function __construct(
+    private string $loaderUrl,
+    private ?string $apiUrl = null,
+    private ?string $applicationUrl = null,
+  ) {
   }
 
   public function getLoaderUrl(): string {
     return $this->loaderUrl;
   }
 
+  public function getApiUrl(): ?string {
+    return $this->apiUrl;
+  }
+
+  public function getApplicationUrl(): ?string {
+    return $this->applicationUrl;
+  }
+
 }
diff --git a/src/Environment/Environment.php b/src/Environment/Environment.php
index 2ac5ad9..a095c9b 100644
--- a/src/Environment/Environment.php
+++ b/src/Environment/Environment.php
@@ -3,7 +3,7 @@
 
 namespace Stromcom\Snippet\Environment;
 
-enum Environment: string implements EnvironmentInterface {
+enum Environment: string implements OriginAwareEnvironmentInterface {
 
   case PRODUCTION = 'https://cdn.stromcom.cz/loader.js';
   case STAGING    = 'https://cdn.staging.stromcom.cz/loader.js';
@@ -12,4 +12,18 @@ public function getLoaderUrl(): string {
     return $this->value;
   }
 
+  public function getApiUrl(): string {
+    return match ($this) {
+      self::PRODUCTION => 'https://www.stromcom.cz',
+      self::STAGING    => 'https://staging.stromcom.cz',
+    };
+  }
+
+  public function getApplicationUrl(): string {
+    return match ($this) {
+      self::PRODUCTION => 'https://app.stromcom.cz',
+      self::STAGING    => 'https://app.staging.stromcom.cz',
+    };
+  }
+
 }
diff --git a/src/Environment/OriginAwareEnvironmentInterface.php b/src/Environment/OriginAwareEnvironmentInterface.php
new file mode 100644
index 0000000..6593e5f
--- /dev/null
+++ b/src/Environment/OriginAwareEnvironmentInterface.php
@@ -0,0 +1,28 @@
+<?php
+declare(strict_types=1);
+
+namespace Stromcom\Snippet\Environment;
+
+/**
+ * An environment that also knows the origins the widget talks to besides the loader.
+ *
+ * The loader URL alone does not identify them — they are separate hosts that cannot be
+ * guessed reliably (the API may even sit behind a CDN distribution with an unrelated
+ * hostname), so {@see \Stromcom\Snippet\CspPolicy} reads them from here instead.
+ *
+ * Both getters may return null when the environment does not know the origin; the caller
+ * then has to be given the URL explicitly.
+ */
+interface OriginAwareEnvironmentInterface extends EnvironmentInterface {
+
+  /**
+   * Origin the widget polls for notifications, e.g. `https://www.stromcom.cz`.
+   */
+  public function getApiUrl(): ?string;
+
+  /**
+   * Origin the widget iframe is embedded from, e.g. `https://app.stromcom.cz`.
+   */
+  public function getApplicationUrl(): ?string;
+
+}
diff --git a/src/Exception/CspException.php b/src/Exception/CspException.php
new file mode 100644
index 0000000..8515f7f
--- /dev/null
+++ b/src/Exception/CspException.php
@@ -0,0 +1,10 @@
+<?php
+declare(strict_types=1);
+
+namespace Stromcom\Snippet\Exception;
+
+use Stromcom\Snippet\SnippetException;
+
+class CspException extends SnippetException {
+
+}
diff --git a/src/Internal/Generator.php b/src/Internal/Generator.php
index 3a5fd22..ad05c51 100644
--- a/src/Internal/Generator.php
+++ b/src/Internal/Generator.php
@@ -23,10 +23,12 @@ class Generator {
   private string $dataLayer = 'stromCom';
   private int $initialSpace = 2;
   private bool $withDocs;
+  private ?string $nonce;
 
-  public function __construct(?string $dataLayer = null, bool $withDocs = false) {
+  public function __construct(?string $dataLayer = null, bool $withDocs = false, ?string $nonce = null) {
     $this->dataLayer = $dataLayer ?? $this->dataLayer;
     $this->withDocs = $withDocs;
+    $this->nonce = $nonce;
   }
 
   public function generateSnippet(string $loaderUrl, string $clientKey, string $clientSecret): SnippetCode {
@@ -37,13 +39,13 @@ public function generateSnippet(string $loaderUrl, string $clientKey, string $cl
       $secret = $this->jsonEncode($clientSecret);
 
       return new SnippetCode(<<<JS
-              (function(win, d, e, l, k, s) {
-              var dl=l+'DL',c=function(s,n,a){n=n||s;(a?win[dl][n]=[]:null);win[l][s]=function(...p){a?win[dl][n].push(p):win[dl][n]=p;}},f=d.getElementsByTagName(e)[0],j=d.createElement(e);
-              win[dl]=win[dl]||{};win[l]={};c('initUser','user');c('thread','threads',!0);c('conf');c('home',0,!0);
-              ;j.async=true;j.dataset.type='stromcom';j.dataset.l=l;j.dataset.dl=dl;j.dataset.ck=k;j.dataset.cs=s;
-              j.src = {$url}+k;f.parentNode.insertBefore(j,f);
+              (function(win, d, e, l, k, s) {
+              var dl=l+'DL',c=function(s,n,a){n=n||s;(a?win[dl][n]=[]:null);win[l][s]=function(...p){a?win[dl][n].push(p):win[dl][n]=p;}},f=d.getElementsByTagName(e)[0],j=d.createElement(e);
+              win[dl]=win[dl]||{};win[l]={};c('initUser','user');c('thread','threads',!0);c('conf');c('home',0,!0);
+              ;j.async=true;j.dataset.type='stromcom';j.dataset.l=l;j.dataset.dl=dl;j.dataset.ck=k;j.dataset.cs=s;
+              j.src = {$url}+k;f.parentNode.insertBefore(j,f);
               })(window, document, 'script', {$layer}, {$key}, {$secret});
-            JS);
+            JS, $this->nonce);
     } catch (JsonEncodingException $Exception) {
       throw new SnippetGenerationException('Failed to generate snippet code.', 0, $Exception);
     }
@@ -71,7 +73,7 @@ public function generateConf(ConfOptions $options, ?bool $withDocs = null): Snip
 
       return new SnippetCode(<<<JS
               {$this->dataLayer}.conf({$json});
-            JS);
+            JS, $this->nonce);
     } catch (JsonEncodingException $Exception) {
       throw new ConfGenerationException('Failed to generate conf code.', 0, $Exception);
     }
@@ -83,7 +85,7 @@ public function generateUser(UserOptions $options, ?bool $withDocs = null): Snip
 
       return new SnippetCode(<<<JS
               {$this->dataLayer}.initUser({$json});
-            JS);
+            JS, $this->nonce);
     } catch (JsonEncodingException $Exception) {
       throw new UserGenerationException('Failed to generate user code.', 0, $Exception);
     }
@@ -96,7 +98,7 @@ public function generateThread(string $querySelector, ThreadOptions $options, ?b
 
       return new SnippetCode(<<<JS
               {$this->dataLayer}.thread(document.querySelector({$selector}), {$json});
-            JS);
+            JS, $this->nonce);
     } catch (JsonEncodingException $Exception) {
       throw new ThreadGenerationException('Failed to generate thread code.', 0, $Exception);
     }
@@ -108,7 +110,7 @@ public function generateHome(string $querySelector): SnippetCode {
 
       return new SnippetCode(<<<JS
               {$this->dataLayer}.home(document.querySelector({$selector}));
-            JS);
+            JS, $this->nonce);
     } catch (JsonEncodingException $Exception) {
       throw new HomeGenerationException('Failed to generate home code.', 0, $Exception);
     }
diff --git a/src/Internal/NonceValidator.php b/src/Internal/NonceValidator.php
new file mode 100644
index 0000000..11145e6
--- /dev/null
+++ b/src/Internal/NonceValidator.php
@@ -0,0 +1,39 @@
+<?php
+declare(strict_types=1);
+
+namespace Stromcom\Snippet\Internal;
+
+use Stromcom\Snippet\Exception\CspException;
+
+/**
+ * @internal
+ */
+class NonceValidator {
+
+  /**
+   * A CSP nonce is a base64 value; the URL-safe alphabet is accepted as well,
+   * because random_bytes() output is commonly encoded with strtr() or base64url.
+   */
+  private const NONCE_PATTERN = '~^[A-Za-z0-9+/=_-]+$~';
+
+  /**
+   * Returns the nonce unchanged, or null when no nonce is used.
+   *
+   * @throws CspException when the nonce is an empty string or contains characters outside the base64 alphabet
+   */
+  public static function validate(?string $nonce): ?string {
+    if ($nonce === null) {
+      return null;
+    }
+
+    if (preg_match(self::NONCE_PATTERN, $nonce) !== 1) {
+      throw new CspException(sprintf(
+        'Invalid CSP nonce "%s". The nonce must be a non-empty base64 value using only [A-Za-z0-9+/=_-].',
+        $nonce,
+      ));
+    }
+
+    return $nonce;
+  }
+
+}
diff --git a/src/SnippetClient.php b/src/SnippetClient.php
index f1af1d6..1483280 100644
--- a/src/SnippetClient.php
+++ b/src/SnippetClient.php
@@ -6,12 +6,14 @@
 use Stromcom\Snippet\Environment\Environment;
 use Stromcom\Snippet\Environment\EnvironmentInterface;
 use Stromcom\Snippet\Exception\ConfGenerationException;
+use Stromcom\Snippet\Exception\CspException;
 use Stromcom\Snippet\Exception\HomeGenerationException;
 use Stromcom\Snippet\Exception\SnippetGenerationException;
 use Stromcom\Snippet\Exception\ThreadGenerationException;
 use Stromcom\Snippet\Exception\UserGenerationException;
 use Stromcom\Snippet\Hashing\CodeHasherInterface;
 use Stromcom\Snippet\Internal\Generator;
+use Stromcom\Snippet\Internal\NonceValidator;
 use Stromcom\Snippet\Options\ConfOptions;
 use Stromcom\Snippet\Options\SnippetOptions;
 use Stromcom\Snippet\Options\ThreadOptions;
@@ -28,6 +30,9 @@ class SnippetClient {
    * @param string|null              $dataLayer    Custom JS data-layer name (default: "stromCom")
    * @param bool                     $withDocs     Output annotated code with inline JSDoc comments
    * @param CodeHasherInterface|null $codeHasher   When set, `code` in UserOptions/ThreadOptions is automatically hashed via the given hasher
+   * @param string|null              $nonce        CSP nonce of the page; every generated <script> tag is rendered with it
+   *
+   * @throws CspException when the nonce is not a valid base64 value
    */
   public function __construct(
     private string $clientKey,
@@ -36,8 +41,18 @@ public function __construct(
     ?string $dataLayer = null,
     bool $withDocs = false,
     private ?CodeHasherInterface $codeHasher = null,
+    private ?string $nonce = null,
   ) {
-    $this->generator = new Generator($dataLayer, $withDocs);
+    $this->nonce     = NonceValidator::validate($nonce);
+    $this->generator = new Generator($dataLayer, $withDocs, $this->nonce);
+  }
+
+  /**
+   * Content-Security-Policy the host page needs for the widget, pre-filled with this
+   * client's environment and nonce.
+   */
+  public function csp(): CspPolicy {
+    return new CspPolicy($this->environment, $this->nonce);
   }
 
   /**
diff --git a/src/SnippetClientFactory.php b/src/SnippetClientFactory.php
index e4bcbf2..208fb9b 100644
--- a/src/SnippetClientFactory.php
+++ b/src/SnippetClientFactory.php
@@ -5,6 +5,7 @@
 
 use Stromcom\Snippet\Environment\Environment;
 use Stromcom\Snippet\Environment\EnvironmentInterface;
+use Stromcom\Snippet\Exception\CspException;
 use Stromcom\Snippet\Hashing\Base62CodeHasher;
 use Stromcom\Snippet\Hashing\CodeHasherInterface;
 use Stromcom\Snippet\Hashing\HashAlgorithm;
@@ -29,6 +30,9 @@ class SnippetClientFactory {
    * @param EnvironmentInterface $environment    Target environment (default: production)
    * @param string|null          $dataLayer      Custom JS data-layer name (default: "stromCom")
    * @param bool                 $withDocs       Output annotated code with inline JSDoc comments
+   * @param string|null          $nonce          CSP nonce of the page; every generated <script> tag is rendered with it
+   *
+   * @throws CspException when the nonce is not a valid base64 value
    */
   public static function create(
     string $clientKey,
@@ -39,12 +43,13 @@ public static function create(
     EnvironmentInterface $environment = Environment::PRODUCTION,
     ?string $dataLayer = null,
     bool $withDocs = false,
+    ?string $nonce = null,
   ): SnippetClient {
     $codeHasher = $codeHashSecret !== null
         ? self::createHasher($codeHashSecret, $codeHashAlgo, $codeHashBase62)
         : null;
 
-    return new SnippetClient($clientKey, $clientSecret, $environment, $dataLayer, $withDocs, $codeHasher);
+    return new SnippetClient($clientKey, $clientSecret, $environment, $dataLayer, $withDocs, $codeHasher, $nonce);
   }
 
   /**
diff --git a/src/SnippetCode.php b/src/SnippetCode.php
index 4f126e3..3ca0bc6 100644
--- a/src/SnippetCode.php
+++ b/src/SnippetCode.php
@@ -3,19 +3,41 @@
 
 namespace Stromcom\Snippet;
 
+use Stromcom\Snippet\Exception\CspException;
+use Stromcom\Snippet\Internal\NonceValidator;
+
 class SnippetCode {
 
   private string $tagName = 'script';
 
-  public function __construct(private string $code) {
+  /**
+   * @param string      $code  Raw JavaScript
+   * @param string|null $nonce CSP nonce rendered as the `nonce` attribute of the generated <script> tag
+   *
+   * @throws CspException when the nonce is not a valid base64 value
+   */
+  public function __construct(private string $code, private ?string $nonce = null) {
+    $this->nonce = NonceValidator::validate($nonce);
   }
 
   public function getCode(): string {
     return $this->code;
   }
 
+  public function getNonce(): ?string {
+    return $this->nonce;
+  }
+
   public function getHTML(): string {
-    return "<{$this->tagName}>\n{$this->code}\n</{$this->tagName}>";
+    return "<{$this->tagName}{$this->buildAttributes()}>\n{$this->code}\n</{$this->tagName}>";
+  }
+
+  private function buildAttributes(): string {
+    if ($this->nonce === null) {
+      return '';
+    }
+
+    return ' nonce="' . htmlspecialchars($this->nonce, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8') . '"';
   }
 
 }
diff --git a/tests/CspPolicyTest.php b/tests/CspPolicyTest.php
new file mode 100644
index 0000000..7837f9e
--- /dev/null
+++ b/tests/CspPolicyTest.php
@@ -0,0 +1,198 @@
+<?php
+declare(strict_types=1);
+
+namespace Stromcom\Snippet\Tests;
+
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\Attributes\TestWith;
+use PHPUnit\Framework\TestCase;
+use Stromcom\Snippet\CspPolicy;
+use Stromcom\Snippet\Environment\CustomEnvironment;
+use Stromcom\Snippet\Environment\Environment;
+use Stromcom\Snippet\Environment\EnvironmentInterface;
+use Stromcom\Snippet\Exception\CspException;
+use Stromcom\Snippet\Exception\EnvironmentException;
+
+class CspPolicyTest extends TestCase {
+
+  private const NONCE = 'r4nd0m+No/nce==';
+
+  private CspPolicy $policy;
+
+  protected function setUp(): void {
+    $this->policy = new CspPolicy(Environment::PRODUCTION);
+  }
+
+  #[Test]
+  public function production_directives_match_the_documented_policy(): void {
+    $this->assertSame([
+      'script-src'  => ['https://cdn.stromcom.cz'],
+      'connect-src' => ['https://www.stromcom.cz'],
+      'style-src'   => ['https://cdn.stromcom.cz'],
+      'img-src'     => ['data:'],
+      'frame-src'   => ['https://app.stromcom.cz'],
+    ], $this->policy->getDirectives());
+  }
+
+  #[Test]
+  public function staging_directives_use_the_staging_zone(): void {
+    $policy = new CspPolicy(Environment::STAGING);
+
+    $this->assertSame([
+      'script-src'  => ['https://cdn.staging.stromcom.cz'],
+      'connect-src' => ['https://staging.stromcom.cz'],
+      'style-src'   => ['https://cdn.staging.stromcom.cz'],
+      'img-src'     => ['data:'],
+      'frame-src'   => ['https://app.staging.stromcom.cz'],
+    ], $policy->getDirectives());
+  }
+
+  #[Test]
+  public function custom_environment_origins_are_taken_from_the_environment(): void {
+    $environment = new CustomEnvironment(
+      'http://localhost:8082/loader.js',
+      'http://localhost:8080',
+      'http://app.localhost:8080',
+    );
+    $directives = (new CspPolicy($environment))->getDirectives();
+
+    $this->assertSame(['http://localhost:8082'], $directives['script-src']);
+    $this->assertSame(['http://localhost:8080'], $directives['connect-src']);
+    $this->assertSame(['http://app.localhost:8080'], $directives['frame-src']);
+  }
+
+  #[Test]
+  public function only_the_origin_part_of_a_url_is_used(): void {
+    $environment = new CustomEnvironment(
+      'https://cdn.example.com/assets/loader.js?v=2',
+      'https://d142vn70ybbwqc.cloudfront.net/api/app/v1/',
+      'https://chat.example.com/embed',
+    );
+    $directives = (new CspPolicy($environment))->getDirectives();
+
+    $this->assertSame(['https://cdn.example.com'], $directives['script-src']);
+    $this->assertSame(['https://d142vn70ybbwqc.cloudfront.net'], $directives['connect-src']);
+    $this->assertSame(['https://chat.example.com'], $directives['frame-src']);
+  }
+
+  #[Test]
+  #[DataProvider('environmentsWithoutApiUrl')]
+  public function missing_api_origin_throws_instead_of_being_guessed(EnvironmentInterface $environment): void {
+    $this->expectException(CspException::class);
+    $this->expectExceptionMessageMatches('~"connect-src"~');
+
+    new CspPolicy($environment);
+  }
+
+  #[Test]
+  public function missing_application_origin_throws_instead_of_being_guessed(): void {
+    $environment = new CustomEnvironment('https://cdn.example.com/loader.js', 'https://example.com');
+
+    $this->expectException(CspException::class);
+    $this->expectExceptionMessageMatches('~"frame-src"~');
+
+    new CspPolicy($environment);
+  }
+
+  #[Test]
+  public function explicit_urls_complete_an_environment_that_does_not_know_them(): void {
+    $directives = (new CspPolicy(
+      self::createLoaderOnlyEnvironment(),
+      apiUrl: 'https://example.com',
+      applicationUrl: 'https://chat.example.com',
+    ))->getDirectives();
+
+    $this->assertSame(['https://example.com'], $directives['connect-src']);
+    $this->assertSame(['https://chat.example.com'], $directives['frame-src']);
+  }
+
+  #[Test]
+  public function explicit_urls_override_the_environment_origins(): void {
+    $policy = new CspPolicy(
+      Environment::PRODUCTION,
+      apiUrl: 'https://api.example.com/api/app/v1/',
+      applicationUrl: 'https://widget.example.com',
+    );
+    $directives = $policy->getDirectives();
+
+    $this->assertSame(['https://api.example.com'], $directives['connect-src']);
+    $this->assertSame(['https://widget.example.com'], $directives['frame-src']);
+    $this->assertSame(['https://cdn.stromcom.cz'], $directives['script-src']);
+  }
+
+  #[Test]
+  public function nonce_is_added_to_script_src_only(): void {
+    $directives = (new CspPolicy(Environment::PRODUCTION, self::NONCE))->getDirectives();
+
+    $this->assertSame(['https://cdn.stromcom.cz', "'nonce-" . self::NONCE . "'"], $directives['script-src']);
+    $this->assertSame(['https://cdn.stromcom.cz'], $directives['style-src']);
+  }
+
+  #[Test]
+  public function header_name_is_the_standard_csp_header(): void {
+    $this->assertSame('Content-Security-Policy', $this->policy->getHeaderName());
+  }
+
+  #[Test]
+  public function header_value_joins_directives_with_semicolons(): void {
+    $this->assertSame(
+      'script-src https://cdn.stromcom.cz; connect-src https://www.stromcom.cz; '
+      . 'style-src https://cdn.stromcom.cz; img-src data:; frame-src https://app.stromcom.cz',
+      $this->policy->getHeaderValue(),
+    );
+  }
+
+  #[Test]
+  public function meta_tag_contains_the_escaped_header_value(): void {
+    $metaTag = (new CspPolicy(Environment::PRODUCTION, self::NONCE))->getMetaTag();
+
+    $this->assertStringStartsWith('<meta http-equiv="Content-Security-Policy" content="', $metaTag);
+    $this->assertStringEndsWith('">', $metaTag);
+    $this->assertStringContainsString('&#039;nonce-' . self::NONCE . '&#039;', $metaTag);
+  }
+
+  #[Test]
+  public function policy_without_nonce_reports_no_nonce(): void {
+    $this->assertNull($this->policy->getNonce());
+    $this->assertStringNotContainsString('nonce', $this->policy->getHeaderValue());
+  }
+
+  #[Test]
+  #[TestWith(["nonce with space"])]
+  #[TestWith(['nonce"escape'])]
+  #[TestWith([''])]
+  public function invalid_nonce_is_rejected(string $nonce): void {
+    $this->expectException(CspException::class);
+
+    new CspPolicy(Environment::PRODUCTION, $nonce);
+  }
+
+  #[Test]
+  #[TestWith(['loader.js'])]
+  #[TestWith(['/loader.js'])]
+  public function loader_url_without_an_origin_is_rejected(string $loaderUrl): void {
+    $this->expectException(EnvironmentException::class);
+
+    new CspPolicy(new CustomEnvironment($loaderUrl, 'https://example.com', 'https://chat.example.com'));
+  }
+
+  /** @return array<string, array{0: EnvironmentInterface}> */
+  public static function environmentsWithoutApiUrl(): array {
+    return [
+      'environment implementing only EnvironmentInterface' => [self::createLoaderOnlyEnvironment()],
+      'custom environment without origins' => [new CustomEnvironment('https://cdn.example.com/loader.js')],
+    ];
+  }
+
+  /** An integrator's own implementation, which knows nothing but the loader URL. */
+  private static function createLoaderOnlyEnvironment(): EnvironmentInterface {
+    return new class implements EnvironmentInterface {
+      public function getLoaderUrl(): string {
+        return 'https://cdn.example.com/loader.js';
+      }
+
+    };
+  }
+
+}
diff --git a/tests/EnvironmentTest.php b/tests/EnvironmentTest.php
index ede9cd1..614dbcd 100644
--- a/tests/EnvironmentTest.php
+++ b/tests/EnvironmentTest.php
@@ -18,6 +18,17 @@ public function predefined_environment_returns_expected_loader_url(Environment $
     $this->assertSame($expectedUrl, $environment->getLoaderUrl());
   }
 
+  #[Test]
+  #[DataProvider('predefinedEnvironmentOrigins')]
+  public function predefined_environment_knows_its_api_and_application_origin(
+    Environment $environment,
+    string $expectedApiUrl,
+    string $expectedApplicationUrl,
+  ): void {
+    $this->assertSame($expectedApiUrl, $environment->getApiUrl());
+    $this->assertSame($expectedApplicationUrl, $environment->getApplicationUrl());
+  }
+
   #[Test]
   #[TestWith(['http://localhost:8082/loader.js'])]
   #[TestWith(['https://cdn.my-company.com/loader.js'])]
@@ -27,6 +38,22 @@ public function custom_environment_returns_provided_url(string $url): void {
     $this->assertSame($url, $env->getLoaderUrl());
   }
 
+  #[Test]
+  public function custom_environment_has_no_origins_unless_they_are_given(): void {
+    $env = new CustomEnvironment('https://cdn.example.com/loader.js');
+
+    $this->assertNull($env->getApiUrl());
+    $this->assertNull($env->getApplicationUrl());
+  }
+
+  #[Test]
+  public function custom_environment_returns_provided_origins(): void {
+    $env = new CustomEnvironment('https://cdn.example.com/loader.js', 'https://example.com', 'https://chat.example.com');
+
+    $this->assertSame('https://example.com', $env->getApiUrl());
+    $this->assertSame('https://chat.example.com', $env->getApplicationUrl());
+  }
+
   /** @return array<string, array{0: Environment, 1: string}> */
   public static function predefinedEnvironmentUrls(): array {
     return [
@@ -35,4 +62,12 @@ public static function predefinedEnvironmentUrls(): array {
     ];
   }
 
+  /** @return array<string, array{0: Environment, 1: string, 2: string}> */
+  public static function predefinedEnvironmentOrigins(): array {
+    return [
+      'production' => [Environment::PRODUCTION, 'https://www.stromcom.cz', 'https://app.stromcom.cz'],
+      'staging' => [Environment::STAGING, 'https://staging.stromcom.cz', 'https://app.staging.stromcom.cz'],
+    ];
+  }
+
 }
diff --git a/tests/Exception/ExceptionHierarchyTest.php b/tests/Exception/ExceptionHierarchyTest.php
index 84a028d..2e06525 100644
--- a/tests/Exception/ExceptionHierarchyTest.php
+++ b/tests/Exception/ExceptionHierarchyTest.php
@@ -7,6 +7,7 @@
 use PHPUnit\Framework\TestCase;
 use Stromcom\Snippet\Exception\CodeHasherException;
 use Stromcom\Snippet\Exception\ConfGenerationException;
+use Stromcom\Snippet\Exception\CspException;
 use Stromcom\Snippet\Exception\EnvironmentException;
 use Stromcom\Snippet\Exception\GenerationException;
 use Stromcom\Snippet\Exception\HomeGenerationException;
@@ -27,6 +28,7 @@ public function all_exception_layers_extend_snippet_exception(): void {
     $this->assertInstanceOf(SnippetException::class, new OptionsException());
     $this->assertInstanceOf(SnippetException::class, new EnvironmentException());
     $this->assertInstanceOf(SnippetException::class, new CodeHasherException());
+    $this->assertInstanceOf(SnippetException::class, new CspException());
   }
 
   #[Test]
diff --git a/tests/SnippetClientFactoryTest.php b/tests/SnippetClientFactoryTest.php
index 7180b12..fe6aeb5 100644
--- a/tests/SnippetClientFactoryTest.php
+++ b/tests/SnippetClientFactoryTest.php
@@ -14,6 +14,8 @@
 
 class SnippetClientFactoryTest extends TestCase {
 
+  private const NONCE = 'r4nd0m+No/nce==';
+
   #[Test]
   public function create_returns_snippet_client(): void {
     $client = SnippetClientFactory::create('key', 'secret');
@@ -60,6 +62,13 @@ public function create_passes_with_docs_flag(): void {
     $this->assertStringContainsString('/**', $code);
   }
 
+  #[Test]
+  public function create_passes_nonce_to_generated_script_tags(): void {
+    $client = SnippetClientFactory::create('key', 'secret', nonce: self::NONCE);
+
+    $this->assertStringStartsWith('<script nonce="' . self::NONCE . '">', $client->snippet()->getHTML());
+  }
+
   #[Test]
   public function create_with_base62_produces_alphanumeric_code_by_default(): void {
     $client = SnippetClientFactory::create('key', 'secret', codeHashSecret: 'app-secret');
diff --git a/tests/SnippetClientTest.php b/tests/SnippetClientTest.php
index 4efab9d..e8af390 100644
--- a/tests/SnippetClientTest.php
+++ b/tests/SnippetClientTest.php
@@ -9,6 +9,7 @@
 use Stromcom\Snippet\Environment\CustomEnvironment;
 use Stromcom\Snippet\Environment\Environment;
 use Stromcom\Snippet\Exception\ConfGenerationException;
+use Stromcom\Snippet\Exception\CspException;
 use Stromcom\Snippet\Exception\HomeGenerationException;
 use Stromcom\Snippet\Exception\SnippetGenerationException;
 use Stromcom\Snippet\Exception\ThreadGenerationException;
@@ -22,6 +23,8 @@
 
 class SnippetClientTest extends TestCase {
 
+  private const NONCE = 'r4nd0m+No/nce==';
+
   private SnippetClient $client;
 
   protected function setUp(): void {
@@ -92,6 +95,41 @@ public function home_output_contains_expected_tokens(string $expectedToken): voi
     $this->assertStringContainsString($expectedToken, $code);
   }
 
+  #[Test]
+  public function nonce_is_rendered_in_every_generated_script_tag(): void {
+    $client   = new SnippetClient('key', 'secret', Environment::PRODUCTION, nonce: self::NONCE);
+    $expected = '<script nonce="' . self::NONCE . '">';
+
+    $this->assertStringStartsWith($expected, $client->snippet()->getHTML());
+    $this->assertStringStartsWith($expected, $client->conf(new ConfOptions())->getHTML());
+    $this->assertStringStartsWith($expected, $client->user(new UserOptions('u1'))->getHTML());
+    $this->assertStringStartsWith($expected, $client->thread('#el', new ThreadOptions('t1'))->getHTML());
+    $this->assertStringStartsWith($expected, $client->home('#el')->getHTML());
+  }
+
+  #[Test]
+  public function nonce_does_not_change_the_raw_code(): void {
+    $client = new SnippetClient('test-key', 'test-secret', Environment::PRODUCTION, nonce: self::NONCE);
+
+    $this->assertSame($this->client->snippet()->getCode(), $client->snippet()->getCode());
+  }
+
+  #[Test]
+  public function invalid_nonce_is_rejected_by_the_constructor(): void {
+    $this->expectException(CspException::class);
+
+    new SnippetClient('key', 'secret', Environment::PRODUCTION, nonce: 'not a nonce');
+  }
+
+  #[Test]
+  public function csp_policy_uses_the_client_environment_and_nonce(): void {
+    $client     = new SnippetClient('key', 'secret', Environment::STAGING, nonce: self::NONCE);
+    $directives = $client->csp()->getDirectives();
+
+    $this->assertSame(['https://cdn.staging.stromcom.cz', "'nonce-" . self::NONCE . "'"], $directives['script-src']);
+    $this->assertSame(['https://app.staging.stromcom.cz'], $directives['frame-src']);
+  }
+
   #[Test]
   public function custom_data_layer_is_used_in_all_methods(): void {
     $client = new SnippetClient('key', 'secret', Environment::PRODUCTION, 'myLayer');
diff --git a/tests/SnippetCodeTest.php b/tests/SnippetCodeTest.php
new file mode 100644
index 0000000..d68ccb4
--- /dev/null
+++ b/tests/SnippetCodeTest.php
@@ -0,0 +1,49 @@
+<?php
+declare(strict_types=1);
+
+namespace Stromcom\Snippet\Tests;
+
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\Attributes\TestWith;
+use PHPUnit\Framework\TestCase;
+use Stromcom\Snippet\Exception\CspException;
+use Stromcom\Snippet\SnippetCode;
+
+class SnippetCodeTest extends TestCase {
+
+  private const CODE  = 'stromCom.home(document.querySelector("#notifications"));';
+  private const NONCE = 'r4nd0m+No/nce==';
+
+  #[Test]
+  public function html_without_nonce_renders_a_bare_script_tag(): void {
+    $code = new SnippetCode(self::CODE);
+
+    $this->assertSame("<script>\n" . self::CODE . "\n</script>", $code->getHTML());
+    $this->assertNull($code->getNonce());
+  }
+
+  #[Test]
+  public function html_with_nonce_renders_the_nonce_attribute(): void {
+    $code = new SnippetCode(self::CODE, self::NONCE);
+
+    $this->assertSame('<script nonce="' . self::NONCE . "\">\n" . self::CODE . "\n</script>", $code->getHTML());
+    $this->assertSame(self::NONCE, $code->getNonce());
+  }
+
+  #[Test]
+  public function raw_code_is_not_affected_by_the_nonce(): void {
+    $this->assertSame(self::CODE, (new SnippetCode(self::CODE, self::NONCE))->getCode());
+  }
+
+  #[Test]
+  #[TestWith([''])]
+  #[TestWith(['nonce with space'])]
+  #[TestWith(['"><script>alert(1)</script>'])]
+  #[TestWith(["nonce'value"])]
+  public function invalid_nonce_is_rejected(string $nonce): void {
+    $this->expectException(CspException::class);
+
+    new SnippetCode(self::CODE, $nonce);
+  }
+
+}