Configure isolation headers

Startpod requires a cross-origin isolated host page. Return these headers on the page and the assets it loads:

Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: credentialless
Cross-Origin-Resource-Policy: same-origin

Use Cross-Origin-Embedder-Policy: require-corp for the Safari path. Every cross-origin subresource must then opt in with CORS or an appropriate Cross-Origin-Resource-Policy header.

Vite development server

import { defineConfig } from "vite"
import { startpod } from "startpod/vite"

export default defineConfig({
  plugins: [startpod()],
})

To support Safari, select the matching host policy:

startpod({ coep: "require-corp" })

Next.js

import { withStartpod } from "startpod/next"

export default withStartpod({})

Use withStartpod({}, { coep: "require-corp" }) when the host must support Safari.

The Vite integration requires Vite's publicDir to remain enabled. The integrations apply these headers during local development. Your production platform must preserve equivalent response headers on the host page and its resources. Startpod serves its managed runtime and preview resources separately.

Verify the deployment

Open the deployed page and run:

window.crossOriginIsolated

The result must be true. If it is false, inspect the browser console and network panel for a resource blocked by COEP before debugging Startpod itself.