Pendo can't initialize in an embedded new-builder app on a custom domain (no storage in the sandbox)

💬 App Building
2

Summary

Running the third-party Pendo analytics agent (for session replay and in-app guides) inside a new app builder (React) app that is embedded via a pre-authenticated embed URL under a custom domain on Retool Cloud fails, because pendo.initialize() throws and isReady() stays false — the app runs in a sandboxed iframe without allow-same-origin, so localStorage, sessionStorage, and cookies all throw SecurityError.

AI Response

*This is expected, documented behavior rather than a bug. When an app is published on a custom domain (or self-hosted), Retool deliberately runs it inside a sandboxed iframe with allow-same-origin disabled to isolate it from the Retool instance, and this removes access to localStorage, sessionStorage, IndexedDB, Cache API, and cookies. The docs explicitly note that widgets which rely on their own storage, cookies, or login session (e.g. Stripe Checkout, Calendly, reCAPTCHA) may render and then fail once storage is unavailable — the same root cause affecting Pendo, which cannot be worked around via disablePersistence/disableCookies or CSP changes since those don't restore sessionStorage. There is no setting to grant a custom-domain app access to browser storage; the documented recommendation is to route storage/auth-dependent functionality through Retool resources, and the postMessage-to-host approach already in use remains the viable path for usage analytics (though not in-app replay/guides). To keep full storage access for Pendo, serving the app from the standard .retool.app origin (where it already works) rather than a custom domain is the only configuration that avoids the sandbox restriction.

Sources

:bookmark: Publish an app | Retool Docs
Directly confirms that apps published on custom domains run in a sandboxed iframe with allow-same-origin disabled, making localStorage/sessionStorage/cookies unavailable and causing storage-dependent third-party widgets to render then fail.
:bookmark: New React App Builder Iframe CSP Settings
A solved thread where Retool staff explain the new React app builder's restrictive-by-design security, customizable CSP, and how custom-domain restrictions apply to published new-builder apps.

The Community Team is testing out a new automation. Let us know if it's helpful (or not) by leaving a :heart:, :+1:, or :-1:. Or by marking this post as the "Solution"! Let us know if you have any feedback here. :rocket:

1 Like