diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1dd2c973..e4b9cf6a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,4 +1,10 @@
-## Version 1.3.9 - in dev
+## Version 1.4.2 
+
+## Updates 
+
+- A script in an iframe opened by another script can use the IFrame API.
+
+## Version 1.4.0
 
 ### BREAKING CHANGES
 
diff --git a/docs/maps/api-reference.md b/docs/maps/api-reference.md
index 9891a88a..e5fc2c48 100644
--- a/docs/maps/api-reference.md
+++ b/docs/maps/api-reference.md
@@ -190,11 +190,11 @@ WA.goToPage('https://www.wikipedia.org/');
 ### Opening/closing a web page in an iFrame
 
 ```
-openCoWebSite(url: string): void
+openCoWebSite(url : string, allowApi: boolean = false, allowPolicy: string = "") : void
 closeCoWebSite(): void
 ```
 
-Opens the webpage at "url" in an iFrame (on the right side of the screen) or close that iFrame.
+Opens the webpage at "url" in an iFrame (on the right side of the screen) or close that iFrame. `allowApi` allows the webpage to use the "IFrame API" and execute script (it is equivalent to putting the `openWebsiteAllowApi` property in the map). `allowPolicy` grants additional access rights to the iFrame. The `allowPolicy` parameter is turned into an [`allow` feature policy in the iFrame](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-allow).
 
 Example:
 
diff --git a/front/src/Api/Events/OpenCoWebSiteEvent.ts b/front/src/Api/Events/OpenCoWebSiteEvent.ts
index 0fbc0ce2..d2937405 100644
--- a/front/src/Api/Events/OpenCoWebSiteEvent.ts
+++ b/front/src/Api/Events/OpenCoWebSiteEvent.ts
@@ -5,6 +5,8 @@ import * as tg from "generic-type-guard";
 export const isOpenCoWebsite =
     new tg.IsInterface().withProperties({
         url: tg.isString,
+        allowApi: tg.isBoolean,
+        allowPolicy: tg.isString,
     }).get();
 
 /**
diff --git a/front/src/Api/IframeListener.ts b/front/src/Api/IframeListener.ts
index 6c3afa31..47f04aad 100644
--- a/front/src/Api/IframeListener.ts
+++ b/front/src/Api/IframeListener.ts
@@ -114,7 +114,7 @@ class IframeListener {
                     this._loadSoundStream.next(payload.data);
                 }
                 else if (payload.type === 'openCoWebSite' && isOpenCoWebsite(payload.data)) {
-                    scriptUtils.openCoWebsite(payload.data.url, foundSrc);
+                    scriptUtils.openCoWebsite(payload.data.url, foundSrc, payload.data.allowApi, payload.data.allowPolicy);
                 }
 
                 else if (payload.type === 'closeCoWebSite') {
diff --git a/front/src/Api/ScriptUtils.ts b/front/src/Api/ScriptUtils.ts
index e1c94507..08775e4a 100644
--- a/front/src/Api/ScriptUtils.ts
+++ b/front/src/Api/ScriptUtils.ts
@@ -11,8 +11,8 @@ class ScriptUtils {
 
     }
 
-    public openCoWebsite(url: string, base: string) {
-           coWebsiteManager.loadCoWebsite(url, base);
+    public openCoWebsite(url: string, base: string, allowApi: boolean, allowPolicy: string) {
+           coWebsiteManager.loadCoWebsite(url, base, allowApi, allowPolicy);
     }
 
     public closeCoWebSite(){
diff --git a/front/src/iframe_api.ts b/front/src/iframe_api.ts
index 17b979df..0264d0a6 100644
--- a/front/src/iframe_api.ts
+++ b/front/src/iframe_api.ts
@@ -22,7 +22,7 @@ interface WorkAdventureApi {
     openPopup(targetObject: string, message: string, buttons: ButtonDescriptor[]): Popup;
     openTab(url : string): void;
     goToPage(url : string): void;
-    openCoWebSite(url : string): void;
+    openCoWebSite(url : string, allowApi: boolean, allowPolicy: string): void;
     closeCoWebSite(): void;
     disablePlayerControls(): void;
     restorePlayerControls(): void;
@@ -166,11 +166,13 @@ window.WA = {
         }, '*');
     },
 
-    openCoWebSite(url : string) : void{
+    openCoWebSite(url : string, allowApi: boolean = false, allowPolicy: string = "") : void{
         window.parent.postMessage({
             "type" : 'openCoWebSite',
             "data" : {
-                url
+                url,
+                allowApi,
+                allowPolicy,
             } as OpenCoWebSiteEvent
         }, '*');
     },
diff --git a/maps/tests/Metadata/cowebsiteAllowApi.html b/maps/tests/Metadata/cowebsiteAllowApi.html
new file mode 100644
index 00000000..b9affd75
--- /dev/null
+++ b/maps/tests/Metadata/cowebsiteAllowApi.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<html lang="en">
+    <head>
+        <script>
+            var script = document.createElement('script');
+            // Don't do this at home kids! The "document.referrer" part is actually inserting a XSS security.
+            // We are OK in this precise case because the HTML page is hosted on the "maps" domain that contains only static files.
+            script.setAttribute('src', document.referrer + 'iframe_api.js');
+            document.head.appendChild(script);
+        </script>
+    </head>
+    <body>
+    <p>Website opened by script.</p>
+        <script>
+            window.addEventListener('load', () => {
+                WA.sendChatMessage('The iframe opened by a script works !', 'Mr Robot');
+            })
+        </script>
+    </body>
+</html>
\ No newline at end of file
diff --git a/maps/tests/Metadata/cowebsiteAllowApi.js b/maps/tests/Metadata/cowebsiteAllowApi.js
new file mode 100644
index 00000000..71ba96fa
--- /dev/null
+++ b/maps/tests/Metadata/cowebsiteAllowApi.js
@@ -0,0 +1 @@
+WA.openCoWebSite("cowebsiteAllowApi.html", true, "");
\ No newline at end of file
diff --git a/maps/tests/Metadata/cowebsiteAllowApi.json b/maps/tests/Metadata/cowebsiteAllowApi.json
new file mode 100644
index 00000000..55ed615f
--- /dev/null
+++ b/maps/tests/Metadata/cowebsiteAllowApi.json
@@ -0,0 +1,98 @@
+{ "compressionlevel":-1,
+ "height":10,
+ "infinite":false,
+ "layers":[
+        {
+         "data":[0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 52, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+         "height":10,
+         "id":2,
+         "name":"start",
+         "opacity":1,
+         "type":"tilelayer",
+         "visible":true,
+         "width":10,
+         "x":0,
+         "y":0
+        }, 
+        {
+         "data":[33, 34, 34, 34, 34, 34, 34, 34, 34, 35, 41, 42, 42, 42, 42, 42, 42, 42, 42, 43, 41, 42, 42, 42, 42, 42, 42, 42, 42, 43, 41, 42, 42, 42, 42, 42, 42, 42, 42, 43, 41, 42, 42, 42, 42, 42, 42, 42, 42, 43, 41, 42, 42, 42, 42, 42, 42, 42, 42, 43, 41, 42, 42, 42, 42, 42, 42, 42, 42, 43, 41, 42, 42, 42, 42, 42, 42, 42, 42, 43, 41, 42, 42, 42, 42, 42, 42, 42, 42, 43, 49, 50, 50, 50, 50, 50, 50, 50, 50, 51],
+         "height":10,
+         "id":1,
+         "name":"bottom",
+         "opacity":1,
+         "type":"tilelayer",
+         "visible":true,
+         "width":10,
+         "x":0,
+         "y":0
+        }, 
+        {
+         "draworder":"topdown",
+         "id":3,
+         "name":"floorLayer",
+         "objects":[
+                {
+                 "height":116.5,
+                 "id":1,
+                 "name":"",
+                 "rotation":0,
+                 "text":
+                    {
+                     "text":"Test : \nThe iframe is opened by script.\n\nResult : \nA message is send to the chat.",
+                     "wrap":true
+                    },
+                 "type":"",
+                 "visible":true,
+                 "width":295.875,
+                 "x":11.8125,
+                 "y":188.5
+                }],
+         "opacity":1,
+         "type":"objectgroup",
+         "visible":true,
+         "x":0,
+         "y":0
+        }, 
+        {
+         "data":[0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 16, 16, 0, 0, 0, 16, 16, 16, 0, 0, 16, 0, 0, 0, 0, 0, 16, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 16, 0, 0, 0, 16, 0, 0, 0, 0, 0, 0, 0, 0, 16, 0, 0, 16, 16, 0, 0, 16, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 16, 0, 0, 0, 0, 0, 0, 16, 16, 0, 0, 0, 0, 0, 0, 0, 16, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+         "height":10,
+         "id":4,
+         "name":"mushroom",
+         "opacity":1,
+         "type":"tilelayer",
+         "visible":true,
+         "width":10,
+         "x":0,
+         "y":0
+        }],
+ "nextlayerid":5,
+ "nextobjectid":2,
+ "orientation":"orthogonal",
+ "properties":[
+        {
+         "name":"script",
+         "type":"string",
+         "value":"cowebsiteAllowApi.js"
+        }],
+ "renderorder":"right-down",
+ "tiledversion":"1.4.3",
+ "tileheight":32,
+ "tilesets":[
+        {
+         "columns":8,
+         "firstgid":1,
+         "image":"tileset_dungeon.png",
+         "imageheight":256,
+         "imagewidth":256,
+         "margin":0,
+         "name":"tileset_dungeon",
+         "spacing":0,
+         "tilecount":64,
+         "tileheight":32,
+         "tilewidth":32
+        }],
+ "tilewidth":32,
+ "type":"map",
+ "version":1.4,
+ "width":10
+}
\ No newline at end of file
diff --git a/maps/tests/Metadata/tileset_dungeon.png b/maps/tests/Metadata/tileset_dungeon.png
new file mode 100644
index 00000000..fcac082c
Binary files /dev/null and b/maps/tests/Metadata/tileset_dungeon.png differ
diff --git a/maps/tests/index.html b/maps/tests/index.html
index 9c95c281..b7e88925 100644
--- a/maps/tests/index.html
+++ b/maps/tests/index.html
@@ -90,6 +90,14 @@
                     <a href="#" class="testLink" data-testmap="help_camera_setting.json" target="_blank">Test the HelpCameraSettingScene</a>
                 </td>
             </tr>
+            <tr>
+                <td>
+                    <input type="radio" name="test-cowebsite-allowAPI"> Success <input type="radio" name="test-cowebsite-allowAPI"> Failure <input type="radio" name="test-cowebsite-allowAPI" checked> Pending
+                </td>
+                <td>
+                    <a href="#" class="testLink" data-testmap="Metadata/cowebsiteAllowApi.json" target="_blank">Test a iframe opened by a script can use Iframe API</a>
+                </td>
+            </tr>
         </table>
 
         <script>