Standard loader
Paste this before</body>. Replace the app_ id with yours.
load plus idle.
To boot with a signed-in user, queue boot before the loader arrives:
SRI loader
If you require subresource integrity, use the hashed loader and adata-app-id attribute. The hashed file lives at /v1/loader.{hash}.js and is listed in /manifest.json.
connect-src as well as script-src and frame-src. See content security policy.