Content-Security-Policy header not working as expected

I'm trying to make CSP to work using headers, I'm setting the CSP config to Axios headers (not sure if this is the correct way!).

{
  "Content-Security-Policy": "script-src-attr 'self';"
}

It only works when using HTML meta and I need it to work using headers.

  <meta
    http-equiv="Content-Security-Policy"
    content="script-src-attr 'self';"
  />

How can I get headers to work as meta tags?