Session tokens and cookies
Response tokens
Section titled “Response tokens”A response token is 1 to 2048 characters of unpadded base64url. It is single use and lives 300 seconds. It is a claim until your server verifies it: never trust it in the browser.
Firewall cookies
Section titled “Firewall cookies”The firewall integrations set three cookies, each HttpOnly; Secure; SameSite=Lax; Path=/:
| Cookie | Purpose |
|---|---|
__Host-rg_s |
A session token: shows a recent human check to the site’s own rules. |
__Host-rg_c |
The clearance for a challenge. |
__Host-rg_r |
The return path after a challenge. |
The session is established with POST /__rg/session on your own origin (header X-RG-Session-Init); when no integration serves that path, the loader sets __Host-rg_s itself from JavaScript (so that copy is not HttpOnly). The rest of the reserved /__rg/ namespace answers 404. Responses that set a cookie carry Cache-Control: no-store.
The widget runs in its own origin. Check your own legal position for the signals it collects (see security and privacy).
Content Security Policy
Section titled “Content Security Policy”| Directive | Value |
|---|---|
script-src |
https://js.revokegpt.com, or your nonce (pass nonce to load()) |
frame-src |
https://js.revokegpt.com |
connect-src |
nothing (the frame, not your page, calls the API) |
style-src |
nothing: the loader sets CSSOM properties only |
The loader uses no HTML or script sink, so require-trusted-types-for 'script' works.