diff --git a/docs/embed-mode/_index.md b/docs/embed-mode/_index.md
index c63111f3285..bc3c42155a2 100644
--- a/docs/embed-mode/_index.md
+++ b/docs/embed-mode/_index.md
@@ -14,7 +14,7 @@ The ownCloud Web can be consumed by another application in a stripped down versi
 
 ## Getting started
 
-To integrate ownCloud Web into your application, add an iframe element pointing to your ownCloud Web deployed instance with additional query parameter `mode=embed`.
+To integrate ownCloud Web into your application, add an iframe element pointing to your ownCloud Web deployed instance with additional query parameter `embed=true`.
 
 ```html
 <iframe src="<web-url>?mode=embed"></iframe>
@@ -41,7 +41,7 @@ To maintain uniformity and ease of handling, each event encapsulates the same st
 ### Example
 
 ```html
-<iframe src="https://my-owncloud-web-instance?mode=embed"></iframe>
+<iframe src="https://my-owncloud-web-instance?embed=true"></iframe>
 
 <script>
   function selectEventHandler(event) {
@@ -65,7 +65,7 @@ By default, the Embed mode allows users to select resources. In certain cases (e
 ### Example
 
 ```html
-<iframe src="https://my-owncloud-web-instance?mode=embed&embed-target=location"></iframe>
+<iframe src="https://my-owncloud-web-instance?embed=true&embed-target=location"></iframe>
 
 <script>
   function selectEventHandler(event) {
@@ -81,3 +81,25 @@ By default, the Embed mode allows users to select resources. In certain cases (e
   window.addEventListener('message', selectEventHandler)
 </script>
 ```
+
+## Delegate authentication
+
+If you already have a valid `access_token` that can be used to call the API from within the Embed mode and do not want to force the user to authenticate again, you can delegate the authentication. Delegating authentication will disable internal login form in ownCloud Web and will instead use events to obtain the token and update it.
+
+### Configuration
+
+To allow authentication delegation, you need to set a config option `options.embed.delegateAuthentication` to `true`. This can be achieved via query parameter `embed-delegate-authentication=true`. Because we are using `postMessage` method to communicate across different origins, it is best practice to verify that the event originated in known origin and not from some malicious site. To allow this check, you need to set config option `options.embed.delegateAuthenticationOrigin` by adding query parameter `embed-delegate-authentication-origin=my-origin`. The value of this parameter will be compared against the `MessageEvent.origin` value and if they do not match, the token will not be saved.
+
+### Events
+
+#### Opening Embed mode
+
+As we already mentioned, we're using `postMessage` method to allow communication between the Embed mode and parent application. When Embed mode is opened for the first time, user gets redirected to `/web-oidc-callback` page where a message with payload `{ name: 'owncloud-embed:request-token', data: undefined }` is sent to request the `access_token` from the parent application. The parent application should set an event listener before opening the Embed mode and once received, it should send a message with payload `{ name: 'owncloud-embed:refresh-token', data: { access_token: '<bearer-token>' } }`. Once Embed mode receives this message, it will save the token in the store and will automatically authenticate the user.
+
+{{< hint info >}}
+To save unnecessary duplication of messages with only different names, the name in the message payload above is exactly the same as when refreshing the token.
+{{< /hint >}}
+
+#### Refreshing token
+
+When authentication is delegated, the automatic renewal of token inside of ownCloud Web is disabled. In order to refresh the token, a listener is created which awaits a message with payload `{ name: 'owncloud-embed:refresh-token', data: { access_token: '<bearer-token>' } }`. Token will then be automatically replaced inside of the Embed mode.
diff --git a/packages/web-pkg/src/composables/embedMode/useEmbedMode.ts b/packages/web-pkg/src/composables/embedMode/useEmbedMode.ts
index e1fd3ee0f14..f59e8755519 100644
--- a/packages/web-pkg/src/composables/embedMode/useEmbedMode.ts
+++ b/packages/web-pkg/src/composables/embedMode/useEmbedMode.ts
@@ -14,6 +14,14 @@ export const useEmbedMode = () => {
     () => store.getters.configuration.options.embed?.messagesOrigin
   )
 
+  const isDelegatingAuthentication = computed<boolean>(
+    () => isEnabled.value && store.getters.configuration.options.embed.delegateAuthentication
+  )
+
+  const delegateAuthenticationOrigin = computed<string | null>(
+    () => store.getters.configuration.options.embed.delegateAuthenticationOrigin
+  )
+
   const postMessage = <Payload>(name: string, data?: Payload): void => {
     const options: WindowPostMessageOptions = {}
 
@@ -24,5 +32,20 @@ export const useEmbedMode = () => {
     window.parent.postMessage({ name, data }, options)
   }
 
-  return { isEnabled, isLocationPicker, messagesTargetOrigin, postMessage }
+  const verifyDelegatedAuthenticationOrigin = (eventOrigin: string): boolean => {
+    if (!delegateAuthenticationOrigin.value) {
+      return true
+    }
+
+    return delegateAuthenticationOrigin.value === eventOrigin
+  }
+
+  return {
+    isEnabled,
+    isLocationPicker,
+    messagesTargetOrigin,
+    isDelegatingAuthentication,
+    postMessage,
+    verifyDelegatedAuthenticationOrigin
+  }
 }
diff --git a/packages/web-pkg/src/configuration/manager.ts b/packages/web-pkg/src/configuration/manager.ts
index dc1cb574758..bedb921b922 100644
--- a/packages/web-pkg/src/configuration/manager.ts
+++ b/packages/web-pkg/src/configuration/manager.ts
@@ -118,6 +118,24 @@ export class ConfigurationManager {
     set(this.optionsConfiguration, 'isRunningOnEos', get(options, 'isRunningOnEos', false))
 
     set(this.optionsConfiguration, 'ocm.openRemotely', get(options, 'ocm.openRemotely', false))
+
+    set(this.optionsConfiguration, 'embed.enabled', get(options, 'embed.enabled', false))
+    set(this.optionsConfiguration, 'embed.target', get(options, 'embed.target', 'resources'))
+    set(
+      this.optionsConfiguration,
+      'embed.messagesOrigin',
+      get(options, 'embed.messagesOrigin', null)
+    )
+    set(
+      this.optionsConfiguration,
+      'embed.delegateAuthentication',
+      get(options, 'embed.delegateAuthentication', false)
+    )
+    set(
+      this.optionsConfiguration,
+      'embed.delegateAuthenticationOrigin',
+      get(options, 'embed.delegateAuthenticationOrigin', null)
+    )
   }
 
   get options(): OptionsConfiguration {
diff --git a/packages/web-pkg/src/configuration/types.ts b/packages/web-pkg/src/configuration/types.ts
index 27c242412de..32ad878af5f 100644
--- a/packages/web-pkg/src/configuration/types.ts
+++ b/packages/web-pkg/src/configuration/types.ts
@@ -36,7 +36,9 @@ export interface OptionsConfiguration {
   embed?: {
     enabled?: boolean
     target?: string
-    messagesOrigin?: string
+    messagesOrigin?: string | null
+    delegateAuthentication?: boolean
+    delegateAuthenticationOrigin?: string | null
   }
 }
 
diff --git a/packages/web-runtime/src/container/bootstrap.ts b/packages/web-runtime/src/container/bootstrap.ts
index af7b6f6a160..ec239ea57cb 100644
--- a/packages/web-runtime/src/container/bootstrap.ts
+++ b/packages/web-runtime/src/container/bootstrap.ts
@@ -36,6 +36,37 @@ import { Resource } from '@ownclouders/web-client'
 import PQueue from 'p-queue'
 import { extractNodeId, extractStorageId } from '@ownclouders/web-client/src/helpers'
 
+const getEmbedConfigFromQuery = (
+  doesEmbedEnabledOptionExists: boolean
+): RawConfig['options']['embed'] => {
+  const config: RawConfig['options']['embed'] = {}
+
+  if (!doesEmbedEnabledOptionExists) {
+    config.enabled = getQueryParam('embed') === 'true'
+  }
+
+  // Can enable location picker in embed mode
+  const embedTarget = getQueryParam('embed-target')
+
+  if (embedTarget) {
+    config.target = embedTarget
+  }
+
+  const delegateAuthentication = getQueryParam('embed-delegate-authentication')
+
+  if (delegateAuthentication) {
+    config.delegateAuthentication = delegateAuthentication === 'true'
+  }
+
+  const delegateAuthenticationOrigin = getQueryParam('embed-delegate-authentication-origin')
+
+  if (delegateAuthentication) {
+    config.delegateAuthenticationOrigin = delegateAuthenticationOrigin
+  }
+
+  return config
+}
+
 /**
  * fetch runtime configuration, this step is optional, all later steps can use a static
  * configuration object as well
@@ -55,21 +86,14 @@ export const announceConfiguration = async (path: string): Promise<RuntimeConfig
     throw new Error(`config could not be parsed. ${error}`)
   })) as RawConfig
 
-  if (
-    !rawConfig.options?.embed ||
-    !Object.prototype.hasOwnProperty.call(rawConfig.options.embed, 'enabled')
-  ) {
-    rawConfig.options = {
-      ...rawConfig.options,
-      embed: { ...rawConfig.options?.embed, enabled: getQueryParam('embed') === 'true' }
-    }
-  }
-
-  // Can enable location picker in embed mode
-  const embedTarget = getQueryParam('embed-target')
+  const embedConfig = getEmbedConfigFromQuery(
+    rawConfig.options?.embed &&
+      Object.prototype.hasOwnProperty.call(rawConfig.options.embed, 'enabled')
+  )
 
-  if (embedTarget) {
-    rawConfig.options.embed = { ...rawConfig.options.embed, target: embedTarget }
+  rawConfig.options = {
+    ...rawConfig.options,
+    embed: { ...rawConfig.options?.embed, ...embedConfig }
   }
 
   configurationManager.initialize(rawConfig)
diff --git a/packages/web-runtime/src/pages/oidcCallback.vue b/packages/web-runtime/src/pages/oidcCallback.vue
index 5dd1740c6d2..6f06c559a0d 100644
--- a/packages/web-runtime/src/pages/oidcCallback.vue
+++ b/packages/web-runtime/src/pages/oidcCallback.vue
@@ -16,14 +16,16 @@
 </template>
 
 <script lang="ts">
-import { computed, defineComponent, onMounted, ref, unref } from 'vue'
-import { useRoute, useStore } from '@ownclouders/web-pkg'
+import { computed, defineComponent, onBeforeUnmount, onMounted, ref, unref } from 'vue'
+import { useEmbedMode, useRoute, useStore } from '@ownclouders/web-pkg'
 import { authService } from 'web-runtime/src/services/auth'
 
 export default defineComponent({
   name: 'OidcCallbackPage',
   setup() {
     const store = useStore()
+    const { isDelegatingAuthentication, postMessage, verifyDelegatedAuthenticationOrigin } =
+      useEmbedMode()
 
     const error = ref(false)
 
@@ -35,6 +37,19 @@ export default defineComponent({
     })
 
     const route = useRoute()
+
+    const handleRequestedTokenEvent = (event: MessageEvent): void => {
+      if (verifyDelegatedAuthenticationOrigin(event.origin) === false) {
+        return
+      }
+
+      if (event.data?.name !== 'owncloud-embed:refresh-token') {
+        return
+      }
+
+      authService.signInCallback(event.data.data.access_token)
+    }
+
     onMounted(() => {
       if (unref(route).query.error) {
         error.value = true
@@ -44,6 +59,13 @@ export default defineComponent({
         return
       }
 
+      if (unref(isDelegatingAuthentication)) {
+        postMessage<void>('owncloud-embed:request-access-token')
+        window.addEventListener('message', handleRequestedTokenEvent)
+
+        return
+      }
+
       if (unref(route).path === '/web-oidc-silent-redirect') {
         authService.signInSilentCallback()
       } else {
@@ -51,6 +73,10 @@ export default defineComponent({
       }
     })
 
+    onBeforeUnmount(() => {
+      window.removeEventListener('message', handleRequestedTokenEvent)
+    })
+
     return {
       error,
       logoImg,
diff --git a/packages/web-runtime/src/router/setupAuthGuard.ts b/packages/web-runtime/src/router/setupAuthGuard.ts
index 29af800a8ca..5190859e788 100644
--- a/packages/web-runtime/src/router/setupAuthGuard.ts
+++ b/packages/web-runtime/src/router/setupAuthGuard.ts
@@ -1,10 +1,12 @@
 import { extractPublicLinkToken, isIdpContext, isPublicLinkContext, isUserContext } from './index'
 import { Router, RouteLocation } from 'vue-router'
-import { contextRouteNameKey, queryItemAsString } from '@ownclouders/web-pkg'
+import { contextRouteNameKey, queryItemAsString, useEmbedMode } from '@ownclouders/web-pkg'
 import { authService } from '../services/auth/authService'
 
 export const setupAuthGuard = (router: Router) => {
   router.beforeEach(async (to, from) => {
+    const { isDelegatingAuthentication } = useEmbedMode()
+
     if (from && to.path === from.path && !hasContextRouteNameChanged(to, from)) {
       // note: except for the context route, query changes can never trigger re-init of the auth context
       return true
@@ -34,6 +36,10 @@ export const setupAuthGuard = (router: Router) => {
 
     if (isUserContext(router, to)) {
       if (!store.getters['runtime/auth/isUserContextReady']) {
+        if (isDelegatingAuthentication.value) {
+          return { path: '/web-oidc-callback' }
+        }
+
         return { path: '/login', query: { redirectUrl: to.fullPath } }
       }
       return true
@@ -41,6 +47,10 @@ export const setupAuthGuard = (router: Router) => {
 
     if (isIdpContext(router, to)) {
       if (!store.getters['runtime/auth/isIdpContextReady']) {
+        if (isDelegatingAuthentication.value) {
+          return { path: '/web-oidc-callback' }
+        }
+
         return { path: '/login', query: { redirectUrl: to.fullPath } }
       }
       return true
diff --git a/packages/web-runtime/src/services/auth/authService.ts b/packages/web-runtime/src/services/auth/authService.ts
index 102851fe4d1..68a17f216d3 100644
--- a/packages/web-runtime/src/services/auth/authService.ts
+++ b/packages/web-runtime/src/services/auth/authService.ts
@@ -183,9 +183,21 @@ export class AuthService {
   /**
    * Sign in callback gets called from the IDP after initial login.
    */
-  public async signInCallback() {
+  public async signInCallback(access_token?: string) {
     try {
-      await this.userManager.signinRedirectCallback(this.buildSignInCallbackUrl())
+      if (
+        this.configurationManager.options.embed.enabled &&
+        this.configurationManager.options.embed.delegateAuthentication &&
+        access_token
+      ) {
+        await this.userManager.updateContext(access_token, true)
+
+        // Setup a listener to handle token refresh
+        window.addEventListener('message', this.handleDelegatedTokenUpdate)
+      } else {
+        await this.userManager.signinRedirectCallback(this.buildSignInCallbackUrl())
+      }
+
       const redirectRoute = this.router.resolve(this.userManager.getAndClearPostLoginRedirectUrl())
       return this.router.replace({
         path: redirectRoute.path,
@@ -269,6 +281,17 @@ export class AuthService {
       this.store.dispatch('clearSettingsValues')
     ])
   }
+
+  private handleDelegatedTokenUpdate(event: MessageEvent<string>): void {
+    if (
+      this.configurationManager.options.embed.delegateAuthenticationOrigin &&
+      event.origin !== this.configurationManager.options.embed.delegateAuthenticationOrigin
+    ) {
+      return
+    }
+
+    this.userManager.updateContext(event.data, false)
+  }
 }
 
 export const authService = new AuthService()
diff --git a/packages/web-runtime/src/services/auth/userManager.ts b/packages/web-runtime/src/services/auth/userManager.ts
index 6464cf4d742..3e6c8f53692 100644
--- a/packages/web-runtime/src/services/auth/userManager.ts
+++ b/packages/web-runtime/src/services/auth/userManager.ts
@@ -61,7 +61,11 @@ export class UserManager extends OidcUserManager {
       post_logout_redirect_uri: buildUrl(router, '/'),
       accessTokenExpiringNotificationTimeInSeconds: 10,
       authority: '',
-      client_id: ''
+      client_id: '',
+
+      automaticSilentRenew:
+        !options.configurationManager.options.embed?.enabled ||
+        !options.configurationManager.options.embed.delegateAuthentication
     }
 
     if (options.configurationManager.isOIDC) {
diff --git a/packages/web-runtime/src/store/config.ts b/packages/web-runtime/src/store/config.ts
index c51d0ca6154..6a257a64ef4 100644
--- a/packages/web-runtime/src/store/config.ts
+++ b/packages/web-runtime/src/store/config.ts
@@ -77,7 +77,9 @@ const state = {
     embed: {
       enabled: false,
       target: 'resources',
-      messagesOrigin: null
+      messagesOrigin: null,
+      delegateAuthentication: false,
+      delegateAuthenticationOrigin: null
     }
   }
 }
diff --git a/packages/web-runtime/tests/unit/pages/oidcCallback.spec.ts b/packages/web-runtime/tests/unit/pages/oidcCallback.spec.ts
new file mode 100644
index 00000000000..5cb1cf4630d
--- /dev/null
+++ b/packages/web-runtime/tests/unit/pages/oidcCallback.spec.ts
@@ -0,0 +1,146 @@
+import {
+  RouteLocation,
+  createStore,
+  defaultComponentMocks,
+  defaultPlugins,
+  defaultStoreMockOptions,
+  shallowMount
+} from 'web-test-helpers'
+import oidcCallback from '../../../src/pages/oidcCallback.vue'
+import { authService } from 'web-runtime/src/services/auth'
+import { mock } from 'jest-mock-extended'
+
+jest.mock('@ownclouders/web-pkg', () => ({
+  ...jest.requireActual('@ownclouders/web-pkg'),
+  useRoute: jest.fn().mockReturnValue({ query: {} })
+}))
+
+describe('oidcCallback page', () => {
+  afterEach(() => {
+    jest.clearAllMocks()
+  })
+
+  describe('delegated authentication', () => {
+    it('when authentication is delegated does not call signInCallback immediately', () => {
+      jest.spyOn(window, 'postMessage').mockImplementation(() => undefined)
+
+      const signInCallbackSpy = jest
+        .spyOn(authService, 'signInCallback')
+        .mockImplementation(() => Promise.resolve())
+
+      getWrapper({ embedOptions: { enabled: true, delegateAuthentication: true } })
+
+      expect(signInCallbackSpy).not.toHaveBeenCalled()
+    })
+
+    it('when authentication is not delegated calls signInCallback immediately', () => {
+      const signInCallbackSpy = jest
+        .spyOn(authService, 'signInCallback')
+        .mockImplementation(() => Promise.resolve())
+
+      getWrapper()
+
+      expect(signInCallbackSpy).toHaveBeenCalled()
+    })
+
+    it('when authentication is delegated calls postMessage with token request event', () => {
+      jest.spyOn(window, 'postMessage').mockImplementation(() => undefined)
+
+      jest.spyOn(authService, 'signInCallback').mockImplementation(() => Promise.resolve())
+
+      getWrapper({ embedOptions: { enabled: true, delegateAuthentication: true } })
+
+      expect(window.parent.postMessage).toHaveBeenCalledWith(
+        {
+          name: 'owncloud-embed:request-access-token',
+          data: undefined
+        },
+        {}
+      )
+    })
+
+    it('when token refresh event is received calls signInCallback', async () => {
+      jest.spyOn(window, 'postMessage').mockImplementation(() => undefined)
+
+      const signInCallbackSpy = jest
+        .spyOn(authService, 'signInCallback')
+        .mockImplementation(() => Promise.resolve())
+
+      getWrapper({ embedOptions: { enabled: true, delegateAuthentication: true } })
+
+      // @ts-expect-error the postMessage is a mocked function here so the type error is incorrect
+      window.postMessage.mockRestore()
+
+      window.postMessage(
+        {
+          name: 'owncloud-embed:refresh-token',
+          data: { access_token: 'access-token' }
+        },
+        '*'
+      )
+
+      await new Promise<void>((resolve) => setTimeout(() => resolve(), 10))
+
+      expect(signInCallbackSpy).toHaveBeenCalledWith('access-token')
+    })
+
+    it('when token refresh event is received but name is incorrect does not call signInCallback', async () => {
+      jest.spyOn(window, 'postMessage').mockImplementation(() => undefined)
+
+      const signInCallbackSpy = jest
+        .spyOn(authService, 'signInCallback')
+        .mockImplementation(() => Promise.resolve())
+
+      getWrapper({
+        embedOptions: {
+          enabled: true,
+          delegateAuthentication: true
+        }
+      })
+
+      // @ts-expect-error the postMessage is a mocked function here so the type error is incorrect
+      window.postMessage.mockRestore()
+
+      window.postMessage(
+        {
+          name: 'refresh-token',
+          data: { access_token: 'access-token' }
+        },
+        '*'
+      )
+
+      await new Promise<void>((resolve) => setTimeout(() => resolve(), 10))
+
+      expect(signInCallbackSpy).not.toHaveBeenCalled()
+    })
+  })
+})
+
+function getWrapper({ embedOptions = {} } = {}) {
+  const storeOptions = { ...defaultStoreMockOptions }
+
+  storeOptions.getters.configuration.mockReturnValue({
+    server: 'http://server/address/',
+    options: { embed: embedOptions },
+    currentTheme: { logo: {}, general: {} }
+  })
+
+  const store = createStore(storeOptions)
+
+  const mocks = {
+    ...defaultComponentMocks({
+      currentRoute: mock<RouteLocation>({ query: {} })
+    })
+  }
+
+  return {
+    storeOptions,
+    wrapper: shallowMount(oidcCallback, {
+      global: {
+        plugins: [...defaultPlugins(), store],
+        mocks,
+        provide: {}
+      }
+    })
+  }
+}
diff --git a/packages/web-runtime/tests/unit/services/auth/authService.spec.ts b/packages/web-runtime/tests/unit/services/auth/authService.spec.ts
index cef73fa23f1..7e19a490f8e 100644
--- a/packages/web-runtime/tests/unit/services/auth/authService.spec.ts
+++ b/packages/web-runtime/tests/unit/services/auth/authService.spec.ts
@@ -1,3 +1,4 @@
+import { ConfigurationManager } from '@ownclouders/web-pkg'
 import { AuthService } from 'web-runtime/src/services/auth/authService'
 import { createRouter } from 'web-test-helpers/src'
 
@@ -18,6 +19,7 @@ describe('AuthService', () => {
       'parses query params and passes them explicitly to router.replace: %s => %s %s',
       async (url, path, query: any) => {
         const authService = new AuthService()
+        const configurationManager = new ConfigurationManager()
 
         jest.replaceProperty(authService as any, 'userManager', {
           signinRedirectCallback: jest.fn(),
@@ -27,7 +29,12 @@ describe('AuthService', () => {
         const router = createRouter()
         const replaceSpy = jest.spyOn(router, 'replace')
 
-        authService.initialize(null, null, null, router, null, null)
+        configurationManager.initialize({
+          server: 'http://server/address/',
+          options: { embed: { enabled: false } }
+        })
+
+        authService.initialize(configurationManager, null, null, router, null, null)
 
         await authService.signInCallback()