I can see you’re already using body-end.html in your scene. Whitelisting is not required for the integration if you communicate your parent web page with the iframe using postMessage. Take a look at this post to learn what code you need to add on both ends: in the parent web page, and in the body-end.html of the scene.