We are an ISV org and building out a new 'Text an Agent' feature. However the initial OAuth page is not being displayed in the iframe.

In the picture below highlighted in the yellow box is the iframe where we make a call out to our mobile server to display the issue thread related to the highlighted issue on the left, in this example is IS076.

We've discovered salesforce explicitly deny's the OAuth page to be in an iframe, see highlight X-Fram-Option: DENY.

Therefore the solution appears to be: pop-out to a new widow to the OAuth page when required. However how/who would do that? The salesforce side or on our mobile server?

Once we authenticate the user it works as designed so it's just the first time a user needs to authenticate. Any help/ideas appreciated.

Our app in Salesforce: enter image description here

  • Possible duplicate of oAuth from VF Page in New Lightning - Cannot redirect vf page to login.salesforce.com
    – Eric
    Commented May 1, 2016 at 15:47
  • Do you have the remote page as a plain <iframe> in the VF page? Any reason you don't want to create a Canvas app and embed it with <apex:canvasApp> in your VF page?
    – Miichi
    Commented May 10, 2016 at 10:30
  • The best workaround for this would be you do oAuth on VF page and once you get token then use that in your iframce. Commented May 13, 2016 at 17:23
  • if you have access to source code of iframe, you can create communication bitween iframe and main page via post messages and do all needed stuff Commented May 13, 2016 at 20:30

1 Answer 1


You have 2 question:

1) how/who would do pop-out to a new widow to the OAuth?

2) The salesforce side or on our mobile server?

Here are steps that you can follow to solve this and you will get answers in these steps:

1) On your agent console page check if user is already authenticated with your mobile server. As you said its fine if authentication is done so no need to do anything further

2) If user is not authenticated you can redirect your user to new VF page and start oAuth flow or provide link on agent console page to start oAuth flow

3) You will need to create callback page on sales force and make is public using site (there are other alternatives to this but lets keep is simple)

4) on your mobile server oAuth is already there so no i dont think you will need any major changes there(the only change i can think is call back url for oAuth)

5) once oAuth is done and you have token you can redirect user to agent console page

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .