diff --git a/src/dev-center/js/dev-center.js b/src/dev-center/js/dev-center.js
index 347328c4..34ef844e 100644
--- a/src/dev-center/js/dev-center.js
+++ b/src/dev-center/js/dev-center.js
@@ -258,6 +258,11 @@ async function create_app(title, source_path = null, items = null) {
             maximizeOnStart: false,
             background: false,
             dedupeName: true,
+            metadata: {
+                window_resizable: true,
+                credentialless: true,
+            },
+    
         })
         .then(async (app) => {
             let app_dir;
@@ -568,6 +573,13 @@ function generate_edit_app_section(app) {
                     <p>When locked, the app cannot be deleted. This is useful to prevent accidental deletion of important apps.</p>
                 </div>
 
+                <h3 style="border-bottom: 1px solid #EEE; margin-top: 50px; margin-bottom: 0px;">Advanced</h3>
+                <div style="margin-top:30px;">
+                    <input type="checkbox" id="edit-app-credentialless" name="edit-app-credentialless" value="true" ${(app.metadata?.credentialless === true || app.metadata === undefined || app.metadata.credentialless === undefined) ? 'checked' : ''}>
+                    <label for="edit-app-credentialless" style="display: inline;">Credentialless</label>
+                    <p><code>credentialless</code> attribute for the <code>iframe</code> tag.</p>
+                </div>
+
                 <hr style="margin-top: 40px;">
                 <button type="button" class="edit-app-save-btn button button-primary">Save</button>
             </form>
@@ -962,6 +974,7 @@ $(document).on('click', '.edit-app-save-btn', async function (e) {
             window_resizable: $('#edit-app-window-resizable').is(":checked"),
             hide_titlebar: $('#edit-app-hide-titlebar').is(":checked"),
             locked: $(`#edit-app-locked`).is(":checked") ?? false,
+            credentialless: $(`#edit-app-credentialless`).is(":checked") ?? true,
         },
         filetypeAssociations: filetype_associations,
     }).then(async (app) => {
diff --git a/src/gui/src/UI/UIWindow.js b/src/gui/src/UI/UIWindow.js
index dfc63bbc..203b3789 100644
--- a/src/gui/src/UI/UIWindow.js
+++ b/src/gui/src/UI/UIWindow.js
@@ -326,7 +326,7 @@ async function UIWindow(options) {
                         frameborder="0" 
                         ${options.iframe_url ? 'src="'+ html_encode(options.iframe_url)+'"' : ''}
                         ${options.iframe_srcdoc ? 'srcdoc="'+ html_encode(options.iframe_srcdoc) +'"' : ''}
-                        ${window.co_isolation_enabled
+                        ${(window.co_isolation_enabled && options.iframe_credentialless !== false)
                             ? 'credentialless '
                             : ''
                         }
diff --git a/src/gui/src/helpers/launch_app.js b/src/gui/src/helpers/launch_app.js
index e6c4f8da..a260f15a 100644
--- a/src/gui/src/helpers/launch_app.js
+++ b/src/gui/src/helpers/launch_app.js
@@ -301,6 +301,12 @@ const launch_app = async (options)=>{
         if(app_info.metadata?.hide_titlebar !== undefined && typeof app_info.metadata.hide_titlebar === 'boolean')
             hide_titlebar = app_info.metadata.hide_titlebar;
 
+        // credentialless
+        let credentialless = true;
+        if(app_info.metadata?.credentialless !== undefined && typeof app_info.metadata.credentialless === 'boolean')
+            credentialless = app_info.metadata.credentialless;
+
+        console.log('credentialless', credentialless);
         // open window
         el_win = UIWindow({
             element_uuid: uuid,
@@ -316,6 +322,7 @@ const launch_app = async (options)=>{
             height: window_height,
             width: window_width,
             app: options.name,
+            iframe_credentialless: credentialless,
             is_visible: ! app_info.background,
             is_maximized: options.maximized,
             is_fullpage: options.is_fullpage,