# How to Allow Auth0-Protected Admin Panel in an iFrame (Partner Hardware Integration)

**URL:** <https://community.auth0.com/t/how-to-allow-auth0-protected-admin-panel-in-an-iframe-partner-hardware-integration/188417>\
**Category:** Get Help\
**Tags:** classic-universal-login-experience, login-experience\
**Created:** [June 25, 2025, 2:46pm UTC](https://community.auth0.com/t/how-to-allow-auth0-protected-admin-panel-in-an-iframe-partner-hardware-integration/188417 "2025-06-25T14:46:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![lion](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/lion/32/48966_2.png) [@lion](https://community.auth0.com/u/lion)\
**Post date:** [June 25, 2025, 2:46pm UTC](https://community.auth0.com/t/how-to-allow-auth0-protected-admin-panel-in-an-iframe-partner-hardware-integration/188417/1 "2025-06-25T14:46:18Z")

</div>

We are embedding our SaaS admin panel into the hardware interface of a partner via an iframe. Our application uses Auth0 for authentication. However, the admin panel is currently blocked from being loaded in an iframe due to standard security policies like `X-Frame-Options` and `Content-Security-Policy (CSP)` settings enforced by Auth0 and the application.

### What We Need:

- Allow our admin panel (protected via Auth0) to be embedded into an iframe **only on partner domains or hardware interfaces**.
- Still maintain security against clickjacking and other web-based attacks.
- Ideally, avoid relaxing policies globally — limit to trusted origins only.

### What We’ve Tried:

- Adding the domain of the partner in auth0, allowed callback urls, allowed logout urls, allowed web origins

### Questions:

1. How can we configure Auth0 to allow our login flow to work **within an iframe** on trusted domains?

### Additional Info:

- We use SPA + API

---

<div class="post-metadata">

**Author:** ![lion](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/lion/32/48966_2.png) [@lion](https://community.auth0.com/u/lion)\
**Post date:** [June 25, 2025, 2:47pm UTC](https://community.auth0.com/t/how-to-allow-auth0-protected-admin-panel-in-an-iframe-partner-hardware-integration/188417/2 "2025-06-25T14:47:18Z")

</div>

oh sorry and also we tried allowed origins (cors)