@Victor Chen I am in no way an expert on CORS, cookies, or any of that jazz, but I do have a question regarding the custom URL requirement. I have successfully implemented the VA in external sites without configuring a custom URL - with and without SSO - and I am just wondering how that's possible? I've used our xyz.service-now.com domain for the embed URL and set the two com.glide.cs.embed properties as described in the documentation and in this article.