Can't embed app in an iframe with the new app builder

💬 Feature Requests
,
1

Hi there, right now with the new AI app builder, apps can’t be embedded inside an iframe. It was possible before with classic apps, so we can’t migrate our most important app (embedded within Salesforce) and we’re a bit stuck. Would it be possible de fix that? Seems like a small fix

2

Summary

With the new AI app builder, apps can't be embedded inside an iframe (something that worked with classic apps), which is blocking migration of a key app that needs to be embedded within Salesforce.

AI Response

This is a known, confirmed limitation: apps built in the new app builder cannot currently be embedded in an iframe. New app builder pages enforce a restrictive frame-src content security policy that blocks them from rendering inside an iframe, and the auth callback breaks in that context. Retool staff have confirmed this scenario is not yet supported but is being tracked internally as a high-priority request. For now, the only reliable path is to link out to the new app rather than iframe it, or to keep the app in the classic builder until native embed support ships.

Sources

:bookmark: Embedding new Retool AI app into Classic app
A Retool staff member confirms embedding a new app builder app via iframe (yielding an 'Invalid auth callback' error) isn't currently supported but is being tracked as a high-priority request.
:bookmark: Embedding New Retool Apps inside Classic Apps?
Corroborates the same limitation and explains the root cause—the new app builder page enforces a restrictive frame-src CSP header—while confirming the recommended interim approach is to link out rather than iframe.

The Community Team is testing out a new automation. Let us know if it's helpful (or not) by leaving a :heart:, :+1:, or :-1:. Or by marking this post as the "Solution"! Let us know if you have any feedback here. :rocket:

3

Hello there @Samy_M_Nasri welcome to the Community! :partying_face:

You're right, new app builder apps can't be embedded in an iframe yet the way Classic apps can. It's a known limitation. You can see it listed under Capabilities and limitations. It's on our radar, and I've logged your Salesforce use case on our internal tracking ticket.

For now the reliable path is to link out to the new app rather than embed it. I'll follow up here as soon as I have an update! :folded_hands:

1 Like
4

Hello @ChiEn thanks a lot for your answer, I hope you’ll be able to prioritize this soon, otherwise we’ll have no choice but to redevelop the app with Claude without Retool :grimacing: (our app is quite big, so we face performance issues with the old classic builder, we need to migrate it very soon)

5

Hi again @Samy_M_Nasri! Just wanted to let you know I've checked in internally on this one. I'll follow up here as soon as I hear back. Thanks for your patience! :folded_hands:

7

Hello @Samy_M_Nasri, this is on our to-do list right now, thanks for your patience again!

1 Like
8

Hi @ChiEn
is there any update on this? We also want to start embedding other Retool apps in our apps. Is it possible to give a timeline for this feature to be released?

9

Hey there @gourav welcome to the Community! :partying_face:

Good news to share on this one! It's been picked up by an engineer and work is getting underway. I don't have a firm release date to promise just yet, but I'll follow up here as soon as I have something concrete! :folded_hands:

10

Hello hello @gourav! I am the engineer working on this! To clarify, is the use case you’re looking for just a simple iframe with the R2 app in the url?

1 Like
11

Yes, that’s correct.

1 Like
13

We have a released this in cloud behind a feature flag–if you give me your org name or email, I can turn the FF on for you!

14

Thank you!
Org Name: Inex One. The email: gourav@inex.one.

15

Enabled!
To get the iframe embedding working:

  1. If you are trying to iframe an R2 app in a non-Retool app, add the parent domain in allow-ancestors CSP in /settings/app-security

  2. If you are trying to iframe an R2 app in a retool classic app, you need to put the retool url (e.g. felix.retool.com) in frame-ancestors CSP in /settings/app-security AND click the "storage and cookies" checkbox in the iframe component

  3. If you are trying to iframe an R2 app in an R2 app, you need to put the parent R2 app url in frame-ancestors CSP and put the child R2 app url in frame-src CSP in /settings/app-security

1 Like
16

Thanks @Isabella_Borkovic

I want this enabled for all users with @inex.one email - not just me please.

17

Ah yes that makes sense – done! Let me know if it doesn’t work