---
sourceDocument: Australia Conversational Interfaces
sourceDocumentLink: https://www.servicenow.com/docs/r/conversational-interfaces

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Conversational Interfaces

ft:clusterId :

    - convint

bundleId :

    - convint

workflow :

    - Platform


---

# Configure the portable chat widget

# Configure the portable Virtual Agent chat widget {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read  
Configure the portable Virtual Agent chat widget to run Virtual Agent on third-party web pages.

## Before you begin

Note:  
For the enhanced chat Virtual Agent display experience, the assistant's Allow public access for this assistant check box must be selected to instantiate correctly, regardless if you want guest sessions. Go
to Conversational InterfacesAssistant Designer\[Assistant name\] and select Edit. While editing the assistant, go to SettingsDisplay experiences, and then select the Allow public access for this assistant check box and Save. For more information about this check box, see [Display your assistant on a portal, channel, or mobile app](https://www.servicenow.com/docs/d0gS20y_GOvvL45UPn~l4Q "Select a display experience for your chat assistant. Display experiences are the different places where a user can find and interact with an assistant. Select from a list of portals, messaging channels, and mobile app. To activate an assistant, at least one display experience must be configured.").

For the standard chat Virtual Agent display experience, the chat widget is only accessible to authenticated users by default. To allow unauthenticated users to access the chat widget, you must enable the
sn_va_web_client_app_embed page for public access. For more information, see [Make UI pages public or private](https://www.servicenow.com/docs/access?context=t_MakeAPagePublic&version=australia&pubname=australia-platform-security&ft:locale=en-US) and [Enable public access to the chat widget](https://www.servicenow.com/docs/gf7o8oTmDRbrU5FM~b8n4w "Enable public access to the standard chat Virtual Agent chat widget for portals.").

Role required: admin

## About this task

ServiceNow only supports the portable Virtual Agent when the top-level domain and domain name match the site that is loading the chat widget. SSO is only supported through the service-now.com URL. Anything beyond that will require custom solution
and implementation.

## Procedure

1. Navigate to All, and then enter <kbd class="ph userinput">sys_properties.list</kbd> in the filter.
2. In the System Properties \[sys_properties\] table, search for the com.glide.cs.embed.csp_frame_ancestors property by name.
3. Select the property name to open the form and specify the directive values.  
   {#configure-portable-va-web-client__table_mny_mrp_ktb__entry__2}

   | Field | Description |
   |-|-|
   | Type | string This is the default value. |
   | Value | Source value of the HTTP header directive: `Content-Security-Policy:frame-ancestors<source>`This property applies to most major browsers, except for Internet Explorer. Specify one or more sources, including the following: * 'self': Indicates that the origin is the same as the page being served. For example, if the value is 'self' http://mywebsite.com, then the iframe is embedded within the parent domain and mywebsite.com. This is the default value. * host-source: The domains in which the external web page can be embedded. Specify the Internet host site by name, IP address, or optional URL or port number. Site address can start with a wildcard (asterisk) character. Example value: http://\*.example.com * scheme-source: A schema. For example: http: or https: * none: No matching URLs. {#configure-portable-va-web-client__ul_nny_mrp_ktb} |
   [ ]

   {#configure-portable-va-web-client__table_mny_mrp_ktb}
4. Return to the System Properties \[sys_properties\] table to search for the com.glide.cs.embed.xframe_options property by name.
5. Select the property name to open the form and specify the directive values.  
   {#configure-portable-va-web-client__table_mrd_5v5_4qbxxxxx__entry__2}

   | Field | Description |
   |-|-|
   | Type | string This is the default value. |
   | Value | Value of the of the X-Frame-Options header directive, to indicate whether the browser can render an external web page in a frame. Specify one of the following values: * sameorigin: Displays the page in a frame that has the same origin as the page itself. This is the default value. This property applies to older browsers, such as Internet Explorer 11. Example value: allow from https://example.com * deny: Does not display the page in a frame. * allow-from uri: Displays the page only in a frame on the specified origin. Note: This value no longer works in browsers. {#configure-portable-va-web-client__ul_nrd_5v5_4qb} |
   [ ]

   {#configure-portable-va-web-client__table_mrd_5v5_4qbxxxxx}
6. For enhanced chat, return to the System Properties \[sys_properties\] table, and then select New.
7. For enhanced chat, complete the following fields to create the glide.uxf.cors.allowed_assets property, and then Submit.  
   {#configure-portable-va-web-client__table_rf3_b5s_jkc__entry__2}

   | Field | Description |
   |-|-|
   | Name | Enter <kbd class="ph userinput">glide.uxf.cors.allowed_assets</kbd>. |
   | Type | Select string. This is the default value. |
   | Value | Enter <kbd class="ph userinput">embedded-enhanced-chat/index</kbd>. |
   [ ]

   {#configure-portable-va-web-client__table_rf3_b5s_jkc}
8. Configure CORS Rules for the REST API to give access across domains.  
   This rule gives the web domain you specify the rights to call the API that gives it access to the chat widget on the web page without a security restraint. All domains must share a common parent domain. Also, you must create a CORS Rule for each subdomain that you want to support.
   1. Navigate to AllSystem Web ServicesRESTCORS Rules.
   2. Click New.
   3. On the form, fill in the fields.  
      {#configure-portable-va-web-client__table_cvf_c5p_ktb__entry__2}

      | Field | Description |
      |-|-|
      | Name | Unique name for the rule. |
      | Application | Scope of the application. Global is the default value. |
      | REST API | Name of the REST API. Select Conversation Consumer Account \[now/cs\]. |
      | Domain | The domain for your website. For example: https://mycompany.com If you have multiple subdomains for your website, you must create a CORS Rule for each. For example, support.mycompany.com and products.mycompany.com would require two separate CORS Rules. Note: Wildcards are not allowed. |
      | Max age | The number of seconds to cache the client session. After an initial CORS request, further requests from the same client within the specified time do not require a preflight message. If you do not specify a value, the default value of 0 indicates that all requests require a preflight message. |
      [ ]

      {#configure-portable-va-web-client__table_cvf_c5p_ktb}
   4. On the HTTP Methods tab, select GET.  
      The portable chat widget will only receive requests.
   5. Select Submit.
   6. **Optional:** Repeat these steps if you want to add the portable chat widget to another subdomain on your website.
   {#configure-portable-va-web-client__substeps_jmp_vtp_ktb}
9. **Optional:**  
   Note:  
   This step is only applicable if your users must be logged in and authenticated with ServiceNow.
   Standard chat only: Create a JavaScript script that uses the `window.postMessage()` method (Web API) to define event conditions that trigger SSO authentication in a user interface page and returns users to a chat widget page that you specify.  
   To redirect users to a chat widget page, use this string: `"https://<your-instance>.service-now.com/sn_va_web_client_login.do?sysparm_redirect_uri=' + encodeURIComponent(<your-page>)`  
   Note:  
   Before you run the script, use the com.glide.cs.web_client_login_redirect_urls system property to specify the URLs that can be passed in the script. The redirection works only when you specify one or more allowed URLs in the property value. Specify the full redirect URLs or the host part of the URL, such as <kbd class="ph userinput">https://example.com</kbd> .  
   Example script:

       <script>
           window.addEventListener("message", function(e) {
              // redirect to SSO login if the chat widget logs in but is logged in as a guest user(unauthenticated)
             if(e.data.type==="SESSION_CREATED" && e.data.authenticated === false)
               window.location.href = "https://<your-instance>.service-now.com/sn_va_web_client_login.do?sysparm_redirect_uri="+ encodeURIComponent(location.href);
             
             // redirect to SSO login if the ServiceNow platform logs out from underneath the chat widget
             if(e.data.type==="SESSION_LOGGED_OUT")
               window.location.href = "https://<your-instance>service-now.com/sn_va_web_client_login.do?sysparm_redirect_uri=" + encodeURIComponent(location.href);
           });
         </script>

   In this example, authentication is triggered in the specified instance when the SESSION_CREATED or SESSION_LOGGED_OUT events occur. After authentication (when the SSO credentials for users
   are accepted), users are redirected to the embedded chat widget page that you specified in `sn_va-web_client_login.do?sysparm_redirect_uri=' + encodeURIComponent(<your-page>)`, as long as you also
   specified the page URL in the com.glide.cs.web_client_login_redirect_urls property.

## What to do next

[Add the portable Virtual Agent chat widget to a third-party website](https://www.servicenow.com/docs/SnH460uvso~LSbgUuuoXdw "To use the portable chat widget for Virtual Agent on third-party web pages, add the necessary code to your web page.").

*[\>]: and then