---
schema_version: "1"
id: bb475aee3433c6c8d32fa067240959925fead18353e6b78a71141573a76e0140
title: Open CTI and Security
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/service-cloud/api-cti/guides/sforce-api-cti-security.md
canonical_url: https://developer.salesforce.com/docs/service/api-cti/guide/sforce-api-cti-security.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: bec2e1aeb334aecbdcafe5b1b664a2a9a6a351179bcd18f41e787c9b6e3af5cb
products:
  - Open CTI Developer Guide
  - Service Cloud Developer Content
---

# Open CTI and Security

We recommend that all Open CTI implementations use HTTPS in the `reqAdapterUrl` element in their call center definition file. Using HTTPS ensures that traffic between your telephony server and Salesforce is encrypted.

By using HTTPS, Open CTI inherits all the benefits of browser and cloud-based security because it points directly to the softphone provider using a secure connection. When users access the softphone on any Salesforce page, it’s displayed in an iFrame and all messages from the softphone to Salesforce are sent via Window.postMessage() methods. For each message sent, the target is restricted to Salesforce. For each message received, Salesforce verifies its format and the sender origin.

**tip:** For Salesforce Classic console apps, if your CTI phone is running on a server with a non-standard port, make sure to include the port number in your domain. For example, if your server is called `myserver` and your port number is `8500`, include `myserver:8500` as an allowed URL in your Salesforce console. This setting doesn’t apply for Lightning console apps.