# CRM Embed third party website

**URL:** <https://community.hubspot.com/t/crm-embed-third-party-website/121609>\
**Category:** APIs & Integrations\
**Tags:** developer-tools\
**Created:** [November 28, 2024, 7:11pm UTC](https://community.hubspot.com/t/crm-embed-third-party-website/121609 "2024-11-28T19:11:46Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![brian929394](https://avatars.discourse-cdn.com/v4/letter/b/7ab992/32.png) [@brian929394](https://community.hubspot.com/u/brian929394)\
**Post date:** [November 28, 2024, 7:11pm UTC](https://community.hubspot.com/t/crm-embed-third-party-website/121609/1 "2024-11-28T19:11:46Z")

</div>

Hi,

I’m trying to implement a CRM Embed page as detailed here: [2026-03 API reference - HubSpot docs](https://developers.hubspot.com/beta-docs/guides/api/crm/embed).

However, when trying to embed using an iFrame or Embed, it’s not able to access the cookie and hence isn’t logging in. What are my options here?

Thanks,

Brian

---

<div class="post-metadata">

**Author:** ![GiantFocal](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/giantfocal/32/41969_2.png) [@GiantFocal](https://community.hubspot.com/u/GiantFocal)\
**Post date:** [November 29, 2024, 7:39am UTC](https://community.hubspot.com/t/crm-embed-third-party-website/121609/2 "2024-11-29T07:39:45Z")

</div>

Hi @brian929394,

The main problem comes from the way HubSpot cookies and iframes interact, which can be a bit tricky. This often happens when no cookies are related to HubSpot’s DOS protection through Cloudflare. Typically, it occurs when a user hasn’t visited a HubSpot domain in the same browser session before.

Here are your options to address this:

1. Use Request Parameters: Instead of relying on cookies, you can work with the request parameters that HubSpot sends to your application. When your CRM card loads, HubSpot makes a GET request to your endpoint with specific parameters, including the ID and email of the HubSpot user trying to access the card.
2. Domain Configuration: Ensure that your external domain is properly added to your HubSpot account settings, as forms and embeds from unregistered domains may be marked as suspicious.
3. Cookie Banner Configuration: If you use HubSpot’s consent banner, you can configure it to appear only on specific domains and URLs to prevent iframe-related issues.

If you’re still having problems, consider creating a custom solution using the HubSpot API endpoints to manage authentication and user sessions independently from the iframe implementation.