topic Re: Questions About Using Iframes in HubSpot Custom Cards in APIs & Integrations

Questions About Using Iframes in HubSpot Custom Cards

LilaDev — Fri, 22 Aug 2025 15:42:08 GMT

Good morning, community!
I’m new to building HubSpot apps and I have several questions regarding iframes in custom cards. My goal is to create an application that allows me to access my app directly from a custom card, modify certain processes, and reflect those changes back in HubSpot. However, it seems that HubSpot applies some restrictions on JavaScript execution within custom cards.

I’ve explored the PandaDoc CPQ custom card, and it appears to work properly, but I’m not sure what limitations I should expect or what best practices I should keep in mind if I want to build something similar. Could you share your insights or experiences on this topic?

Re: Questions About Using Iframes in HubSpot Custom Cards

Victor_Becerra — Fri, 22 Aug 2025 15:59:52 GMT

Hi @LilaDev
Thank you for reaching out to the Community!
I'd like to invite some community members who are subject matter experts to join this conversation.
@Humashankar @evaldas @sylvain_tirreau - Would you be able to share any insights on this? Your expertise would be greatly appreciated.
Best,
Victor

Re: Questions About Using Iframes in HubSpot Custom Cards

RubenBurdin — Fri, 22 Aug 2025 20:35:09 GMT

Hi @LilaDev

You’re right, HubSpot does apply some restrictions.

Custom cards can display content in an iframe, but the JavaScript that runs inside is sandboxed. That means you won’t have direct access to the HubSpot DOM or APIs from the iframe. The usual pattern is: render your app UI in the iframe, then rely on HubSpot’s CRM Cards API and server-side functions to pass data back and forth (https://developers.hubspot.com/docs/reference/api/crm/extensions/crm-cards )

If you look at PandaDoc CPQ or similar apps, they’re essentially rendering their own hosted UI inside the card. Any HubSpot record updates flow through backend calls, not client-side JavaScript injected into the card.

Best practices are: keep logic in your backend, use secure messaging or API calls for data updates, and expect that HubSpot will enforce CSP headers and block inline scripts.

Some folks also layer in platforms like Stacksync, which handle real-time two-way sync between HubSpot and external systems, so the data inside the iframe is always fresh without extra client-side work.

Hope this helps.

Let me know if this makes sense and if this answers your needs / questions.
If it does, feel free to mark it as a solution.

Re: Questions About Using Iframes in HubSpot Custom Cards

JohnMaret — Mon, 22 Sep 2025 07:06:46 GMT

Hi @LilaDev If you’re looking for an easier way to handle that sync, you might also look at tools like Data Bridge - Bring Any Data into CRM Objects, which can display an iframe UI while managing the HubSpot data exchange in the background.

this is the new app - I've buiild to solve that simple scenario. and I can see a lot of interest from HubSpottters in that domain,

BEst