Whitelisting Domain without API token

Hi Team Zendesk,

I am building an integration where in I load my private app in top bar via iframe. My private app is running on a separate server and I want to whitelist that particular domain. I am adding it to manifest.json however on setting it to true, the URL gets encrypted and doesn't pass to my iframe. I am not calling any API from zendesk , I just need to do bi directional communication. Can you please help?

My code:-

client.metadata().then(function (metadata) {
    let url = metadata.settings.myprivateapp;
    document.getElementById("myprivateappFrame").setAttribute("src", url);
}

Here's my manifest.json :-

"domainWhitelist": ["myprivateapp.org/"],

"parameters": [
  {
    "name": "myprivateapp",
    "type": "url",
    "required": true,
    "secure": true,
    "default": "https:/www.myprivateapp.org/"
  }
  ],