Feature request: interpolate record-context variables in IFRAME page-layout widget URLs (e.g. {{record.id}}, {{record.fieldName}})

[lineshFT]

Use case

We embed an external per-account analytics dashboard on Company record pages via the IFRAME page-layout widget. The external dashboard accepts the account as a URL parameter (https://external.example.com/embed?companyId=…). Today the widget URL is fully static, so every company record shows the same dashboard — the user must search for the account inside the embedded view on every record they open.

What we verified (Twenty Cloud 2.x, July 2026 + current main)

• Placeholder syntax in the widget URL (e.g. ?companyId={{record.companyId}}) is not interpolated — it is passed through literally to the iframe. On current main, the iframe widget configuration is just { url } (packages/twenty-server/src/engine/metadata-modules/page-layout-widget/dtos/iframe-configuration.dto.ts) and IframeWidget.tsx renders configuration.url unchanged via getSafeUrl, with no record context and no postMessage bridge to the embedded page.
• Front components can't substitute for this: component-rendered iframes are force-sandboxed without allow-same-origin (packages/twenty-front-component-renderer/src/host/utils/sanitizeIframeSandbox.ts), so they can't carry the third-party session that the page-layout IFRAME widget (which keeps allow-same-origin) supports.

Proposal

In IframeWidget.tsx (or at widget-config resolution), interpolate a small whitelist of record-context variables in the configured URL when the widget renders on a record page:

• {{record.id}}
• scalar field values by name: {{record.<fieldName>}}

Values URL-encoded; empty string when the field is unset; no expressions or functions — just substitution, consistent with variable tokens elsewhere in Twenty (e.g. workflows).

Question

If there is already a supported way to pass the current record's context to an embedded external page (or one on the roadmap), we'd be glad to use that instead — we couldn't find one in the code, issues, or discussions.

Related (different scope)

• Allow Embedding via iFrame for Selected Trusted Websites #13237 — embedding Twenty in an iframe
• iframe Widget missing allow-same-origin in sandbox attribute #16200 — iframe widget sandbox allow-same-origin
• FrontComponent <iframe> is force-sandboxed with sandbox="", which blocks JS, forms, popups and same-origin #19899 — front-component iframe sandbox

Happy to contribute a PR if the approach sounds right to the team.

[xNima-Dev]

Hi! I would like to work on adding dynamic variable interpolation for IFRAME widget URLs. Could you please assign this issue to me?

[lineshFT]

FYI, the workaround we ended up using was - the iframe widget points to an app-served html page hosted on the Twenty domain itself. Being same-origin, it can read the parent page's URL to grab the current record id, then a helper function resolves that to the external id and redirects the frame to the embed url with it - rendering the right customized record. @xNima-Dev