Testing and going live

Koala provides two environments, staging and production, and the loader script URL is what selects between them: Koala gives you one URL for each. Everything else in your integration is identical.

Test on staging

Point your page at the staging loader URL while you build:

<script async src="https://external-dev-ajax.cartrawler.com/smartblock/koala/loader.js"></script>

Staging behaves like production, but nothing is real, so you can exercise the whole flow safely:

• render the widget and quote trips,
• select and decline bundles,
• make the post-booking calls: create policies and delete quotes,
• make mistakes: malformed trip data, missing fields, duplicate calls.

Run through your guide's checklist against staging before going further.

Network access

If your pages enforce a Content Security Policy or an outbound allow-list, the widget needs these hosts on staging:

Directive	Host	Loads
script-src	external-dev-ajax.cartrawler.com	the loader, then the widget script
style-src	external-dev-ajax.cartrawler.com	the widget stylesheet
img-src	external-dev-ajax.cartrawler.com	the bundle images
connect-src	external-dev-ajax.cartrawler.com	your partner configuration and version files
connect-src	external-dev.cartrawler.com	the live version lookup for your partner
connect-src	partner.api.staging.hikoala.co	the quote request, and the post-booking call if sent from the browser
img-src	ct-errs.cartrawler.com	the loader's failure beacon; optional, only failure reporting is lost

The widget loads no fonts: it applies font-family names from your configuration to fonts your page already has. Terms and conditions documents open as links, not as page resources.

Production uses different hosts for the CDN, the version lookup and the Koala API. Koala gives them to you together with the production loader URL.

If your script-src relies on nonces, allow the host instead: the loader injects the widget script itself and cannot carry your nonce.

Go live

Once the integration is validated on staging, switch the loader script URL to the production one, which Koala hands to you privately, and allow the production hosts. Nothing else changes: same custom element, same window.CTStore shape, same events, same post-booking calls.