We are an ISV org and building out a new 'Text an Agent' feature. However the initial OAuth page is not being displayed in the iframe.
In the picture below highlighted in the yellow box is the iframe where we make a call out to our mobile server to display the issue thread related to the highlighted issue on the left, in this example is IS076.
We've discovered salesforce explicitly deny's the OAuth page to be in an iframe, see highlight X-Fram-Option: DENY.
Therefore the solution appears to be: pop-out to a new widow to the OAuth page when required. However how/who would do that? The salesforce side or on our mobile server?
Once we authenticate the user it works as designed so it's just the first time a user needs to authenticate. Any help/ideas appreciated.