---
"@context": https://schema.org
"@type": TechArticle
"@id": https://www.twilio.com/docs/flex/admin-guide/setup/secure-iframe#article
headline: Securely embed Flex as an iframe
description: Register and update your Allowed URLs list in the Twilio Console if you are embedding flex.twilio.com as an iframe.
url: https://www.twilio.com/docs/flex/admin-guide/setup/secure-iframe
inLanguage: en
dateModified: 2026-07-17T03:41:20.000Z
author:
  "@type": Organization
  name: Twilio Developer Education Team
publisher:
  "@type": Organization
  name: Twilio
---

# Securely embed Flex as an iframe

> \[!NOTE]
>
> Starting **March 3rd, 2021**, all **new Flex applications** are required to register their valid URLs under Twilio Flex's Allowed URLs list in order to embed Flex as an iframe.
>
> Starting **June 29th, 2021**, all Flex applications created before March 3rd, 2021 are required to register their valid URLs under Twilio Flex's Allowed URLs list in order to embed Flex as an iframe.

Twilio's [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy) (CSP) restricts embedding to Twilio-registered URLs. This also applies to [Salesforce](/docs/flex/admin-guide/integrations/salesforce) and [Zendesk](/docs/flex/admin-guide/integrations/zendesk) integrations.

Our security policy helps guard against [cross-site scripting (XSS)](https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting) and other content injection attacks, such as [click-jacking](https://developer.mozilla.org/en-US/docs/Web/Security/Types_of_attacks#click-jacking). Instead of always trusting what a server delivers, Twilio's policy lets you add a list of sources of trusted content. Your allowed URL(s) are added to a CSP header as a [valid frame-ancestor](https://www.w3.org/TR/CSP2/), along with a `report-uri` directive on authenticated Flex requests. This tells your browser to report an error when unregistered URLs are attempting to iframe `flex.twilio.com`.

## Embed Flex as an iframe

These instructions only apply to our hosted `flex.twilio.com` platform.

You can register your domains by accessing the [**Embed Flex as an iframe** page](https://console.twilio.com/us1/develop/flex/settings/embed-as-iframe) of your application on Twilio Console.

If you need to add more URL(s) to your Allowed URLs list, review the [URL Registration Rules](/docs/flex/admin-guide/setup/secure-iframe#url-registration-rules). To test the setting, click **Save**, and refresh your external application.

![Embed Flex as an iframe with allowed URL input and save options.](https://docs-resources.prod.twilio.com/bc7fc28c439a6e561836870e1464321887f858172cfc6daba6f1382024fcbb52.png)

If you registered the external URL correctly, you should be able to log into your Flex application. Unauthenticated requests redirect to the Flex login page.

> \[!WARNING]
>
> If you run into issues with embedding Flex as an iframe, be sure to add your Salesforce lightning URL in the Twilio Console Allowed URLs on the **Embed Flex as an iframe** page (for example: `https://<SFDCdomain>.lightning.force.com`) and turn on third-party cookies in your browser.

> \[!NOTE]
>
> Flex applications created before **March 10th, 2021** automatically populate the allowed URLs list based on your application activity. Review and confirm the allowed URLs are correct.

### URL Registration Rules

When adding your allowed URLs list, keep the following rules in mind:

| `http://contactcenter.example.com`<br /><br />`https://contactcenter.example.com`<br /><br />`http://localhost:8000` | Full URLs are required, without any trailing slashes. For local development, register `localhost:<port>` prefixed by `http` or `https` depending on your configuration. |
| -------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `*.example.com`                                                                                                      | Wildcards aren't supported                                                                                                                                              |
| `https://example.com/supportpage`                                                                                    | URL paths aren't supported                                                                                                                                              |