diff --git a/src/auth/PhutilOAuth1AuthAdapter.php b/src/auth/PhutilOAuth1AuthAdapter.php
--- a/src/auth/PhutilOAuth1AuthAdapter.php
+++ b/src/auth/PhutilOAuth1AuthAdapter.php
@@ -92,6 +92,12 @@
     return 'HMAC-SHA1';
   }
 
+  public function getContentSecurityPolicyFormActions() {
+    return array(
+      $this->getAuthorizeTokenURI(),
+    );
+  }
+
   protected function newOAuth1Future($uri, $data = array()) {
     $future = id(new PhutilOAuth1Future($uri, $data))
       ->setMethod('POST')