# Zero Permissions Zero Permissions is a networking mode for Instant Games that allows your game to make network requests to external servers. By default, Instant Games run in a sandboxed environment that restricts outbound network access to Facebook-owned domains. Zero Permissions lifts this restriction, giving your game the ability to communicate with your own backend servers and third-party APIs. This mode was formerly known as "Network Enabled Zero Permissions" (NEZP). If you see references to NEZP in older documentation or tooling, it refers to the same capability described here. ## Why You Might Need Zero Permissions Many Instant Games can be built entirely as client-side applications, using the Instant Games SDK for data persistence, social features, and monetization. However, some games require server-side capabilities that go beyond what the SDK provides. Zero Permissions enables these use cases. ### Multiplayer and Real-Time Communication If your game features real-time multiplayer gameplay — such as turn-based matches with live updates, cooperative play, or competitive PvP — you likely need a backend server to coordinate game state between players. Zero Permissions allows your game client to open WebSocket connections or make HTTP requests to your multiplayer server. ### Server-Side Game Logic For games that require authoritative server-side logic — such as anti-cheat validation, matchmaking, server-side economy management, or procedural content generation — Zero Permissions enables the game client to communicate with your backend services. ### External APIs and Services If your game integrates with third-party services — such as analytics platforms, custom leaderboard services, content delivery networks for dynamic assets, or machine learning APIs — Zero Permissions allows those outbound requests. ### Custom Authentication and User Management While the Instant Games SDK provides player identity through Facebook, some developers maintain their own user accounts or need to integrate with existing user management systems. Zero Permissions allows your game to authenticate with your own backend. ## How Zero Permissions Works  When Zero Permissions is enabled for your app, the Instant Games runtime relaxes its Content Security Policy (CSP) to allow your game to make network requests to domains outside of Facebook. This includes: - **HTTP/HTTPS requests** (via `fetch`, `XMLHttpRequest`, or similar APIs) to your own servers or third-party APIs. - **WebSocket connections** for real-time communication. - **Loading external resources** such as scripts, images, or other assets from your own CDN. Without Zero Permissions enabled, any attempt to make requests to non-Facebook domains will be blocked by the platform's security policy, and you will see errors in the browser console. ## Enabling Zero Permissions To enable Zero Permissions for your Instant Game: 1. Go to the [App Dashboard](https://developers.facebook.com/apps/) and select your app. 2. Navigate to **Instant Games** in the left sidebar. 3. Under the settings or configuration section, find the **Zero Permissions** option. 4. Toggle **Zero Permissions** to **Enabled**. 5. Save your changes. Once enabled, the change takes effect for all new game sessions. Players who are currently in a session may need to restart the game to pick up the updated configuration. ## Requirements and Considerations ### HTTPS Required All external network requests from your game must use HTTPS. Plain HTTP connections are not supported and will be blocked. Ensure that your backend servers and any third-party APIs you integrate with support HTTPS. ### Domain Restrictions When you enable Zero Permissions, your game can make requests to any domain. There is no allowlist or domain-specific configuration required. However, you are responsible for ensuring that your game only communicates with trusted servers. All standard web security best practices apply. ### Content Security Policy Even with Zero Permissions enabled, the Instant Games runtime applies a Content Security Policy that may affect certain operations. If you encounter CSP-related errors in the browser console, review the specific directive that is being violated and adjust your implementation accordingly. ### App Review Games with Zero Permissions enabled are subject to the same review process as all Instant Games. However, reviewers may ask additional questions about how your game uses network access, particularly if your game communicates with servers that handle player data. Be prepared to explain the purpose of your external network requests. ### Data Privacy and Compliance When your game communicates with external servers, you are responsible for complying with all applicable data privacy laws and Facebook Platform policies. Specifically: - Do not transmit Facebook user data (such as player IDs, names, or photos) to your servers without complying with the [Facebook Platform Terms](https://developers.facebook.com/terms/) and applicable privacy regulations. - Ensure that your server-side data handling practices are documented in your app's privacy policy. - If you store player data on your servers, implement appropriate security measures to protect that data. ### Performance Considerations Network requests to external servers introduce latency that is outside of Facebook's control. Consider the following: - **Minimize blocking requests during loading.** If your game needs to fetch data from your server at startup, do so in parallel with asset loading and report progress to the player using `FBInstant.setLoadingProgress()`. - **Handle network failures gracefully.** Mobile players may have unreliable connections. Implement timeouts, retries, and offline fallbacks where appropriate. - **Use regional servers.** Instant Games have a global audience. If you run your own backend, consider deploying servers in multiple regions to reduce latency for players worldwide. ## Zero Permissions vs. Older Networking Restrictions In earlier versions of the Instant Games platform, networking was either fully restricted (no external requests allowed) or required specific configuration to enable limited access. Zero Permissions replaces these older models with a simpler, unified approach: enable it in the App Dashboard, and your game can make requests to any HTTPS endpoint. If your game was previously configured with an older networking mode, we recommend migrating to Zero Permissions for the most straightforward and fully supported experience. ## Migration Guides If you are moving to Instant Games from another platform, the following guides walk you through the process: - **[Migrating from Canvas Games](https://developers.facebook.com/documentation/games/build/zero-permissions/onboarding-and-migration/canvas-game-migration)** — A step-by-step guide for developers moving from Legacy Web Games (Canvas) to Instant Games with Zero Permissions. - **[Migrating from Facebook Login for Gaming](https://developers.facebook.com/documentation/games/build/zero-permissions/onboarding-and-migration/migrating-from-gaming-login)** — A guide for developers transitioning from Facebook Login for Gaming to the Zero Permissions model. ## Next Steps - **[Quick Start](https://developers.facebook.com/documentation/games/build/quick-start)** — If you are new to Instant Games, start here to build your first game. - **[Unity Plugin](https://developers.facebook.com/documentation/games/sdk-reference/unity-plugin)** — If you are building your game in Unity, use the Unity plugin for C# access to the full SDK including overlay views. - **[Game Testing](https://developers.facebook.com/documentation/games/build/game-testing)** — Learn how to test your game on the platform, including testing network requests. - **[Bundle Configuration](https://developers.facebook.com/documentation/games/build/bundle-configuration)** — Configure your game bundle with `fbapp-config.json`. - **[SDK Reference](https://developers.facebook.com/documentation/games/sdk-reference)** — Full API documentation for the Instant Games SDK.