Skip to main content
Iframe embedding lets you host your Exec workspace inside another site — for example, a customer learning portal, internal LMS, or partner app — so learners can run roleplays, view Skills, and complete assignments without leaving the parent experience. By default, Exec blocks all iframe embedding for security. Workspace admins turn embedding on per workspace by adding the origins that are allowed to embed the site.
Only workspace admins and workspace owners can configure iframe embedding.

​
When to use iframe embedding

Use iframe embedding when you want:
  • Learners to stay inside your own product or LMS instead of opening Exec in a new tab.
  • A lightweight integration that doesn’t require LTI 1.3 setup or grade passback.
  • Full access to the Exec UI (roleplays, Skills, Knowledge Hub, Coaching) from within another site.
If you also need single sign-on from your LMS or completion data pushed back into an LMS gradebook, use LTI 1.3 instead. See LMS Integrations for a side-by-side comparison.

​
Configure allowed origins

  1. Sign in as a workspace admin and open Settings.
  2. Go to the Security tab and find the Iframe Embedding section.
  3. Add each site that should be able to embed your workspace, one origin per line:
    An origin is the scheme plus host (and port, if any) — no paths, no query strings, no trailing slash. Origins must use https://.
  4. Click Save.
Once saved, changes propagate within about a minute. To turn embedding off, click Disable Embedding.
You can list up to 20 origins per workspace. Add every subdomain that needs to embed Exec — https://app.example.com does not cover https://learn.example.com.

​
Allow any origin

If you don’t know the embedding site’s domain in advance — for example, when partners self-serve installs — check Allow any origin to embed this workspace.
Allowing any origin removes clickjacking protection for this workspace. Any site on the internet will be able to embed it. Only use this option if you truly can’t enumerate the embedding sites, and prefer an explicit origin list whenever possible.

​
Embed Exec on the parent site

On the site that will host Exec, add an iframe pointing at your workspace URL:
A few notes on the iframe attributes:
  • allow="storage-access" is required for Safari and other browsers that block third-party cookies by default. Without it, Safari users see a popup login prompt instead of an inline sign-in.
  • camera and microphone are required so learners can run voice roleplays inside the iframe.
  • clipboard-write lets learners copy transcripts and share links.
The parent site must be served over HTTPS. Browsers reject cross-origin iframes on mixed-content pages.

​
How sign-in works inside an iframe

When a learner opens the parent site for the first time:
  1. Exec loads inside the iframe and checks whether the learner already has a session.
  2. If not signed in, and the browser allows third-party cookies, Exec shows the normal sign-in screen inline.
  3. If the browser blocks third-party cookies (default in Safari), Exec opens a small popup for sign-in. Once the learner authenticates, the popup closes and the iframe refreshes automatically.
SSO works the same way as outside an iframe — if your workspace has SSO enabled, the popup or inline flow redirects to your identity provider.

​
Troubleshooting

The embedding site’s origin isn’t in your allowed list. Copy the exact origin from the browser address bar (scheme + host + port, no path) and paste it into Settings → Security → Iframe Embedding. Changes take up to a minute to take effect.
Add allow="storage-access" to the iframe tag on the parent site. Safari blocks third-party cookies by default, and the Storage Access API is how Exec requests permission to sign the learner in. Without this attribute, learners will see a popup sign-in instead.
Make sure the origin uses https:// (not http://), has no path or trailing slash, and matches the parent site exactly. https://example.com and https://www.example.com are different origins.
Not today — the iframe loads the same UI as https://your-workspace.exec.com. You can deep-link to a specific roleplay or Skills page by pointing the src attribute at that URL.

​
Getting Help

Need help? Contact us at [email protected] for help setting up iframe embedding or choosing between iframe and LTI 1.3.