{nonce} answers this request's nonce: 18 random bytes, base64 - one value for the whole request, made on first use. Put it on the scripts and styles the page itself writes: <script nonce="{nonce}">.

The engine puts the same value in the Content-Security-Policy header: 'nonce' (quotes included) in $padCsp becomes 'nonce-<the value>', so $padCsp = "default-src 'self'; script-src 'self' 'nonce'" lets exactly the scripts that carry it run - an injected script cannot know the value. The engine never adds it to script tags by itself, except to the scripts it writes, such as {validator}'s.

Write it outside an {ignore} pair: inside one it is text. The value is new on every request, so a page carrying a nonce is never stored in the page cache, and the examples here are shown, not run.