---
schema_version: "1"
id: 7a0e9e83d96749e27b259e4add81859353388267d417c9b50a67106ba9211f0c
title: Prepare to Build a Lightning Out 2.0 App
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/lightning_out_prepare.md
canonical_url: https://help.salesforce.com/s/articleView?id=platform.lightning_out_prepare.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 25100e2b2dbd96cd19c62e6409d2717f1cfcdaf281251b06ec48920741aea672
description: Before you embed a Lightning Out 2.0 app into an external app, configure some security-related and administrative settings in Salesforce and in your external app. These settings allow Lightning Out 2.0 inline frames (iframes) to load in the external app.
products:
  - Salesforce Platform
  - Security
release: "264"
---
# Prepare to Build a Lightning Out 2.0 App

Before you embed a Lightning Out 2.0 app into an external app, configure some security-related and administrative settings in Salesforce and in your external app. These settings allow Lightning Out 2.0 inline frames (iframes) to load in the external app.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
        <colgroup>
          <col>
        </colgroup>
        <tbody>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">Available in: Lightning Experience</td>

          </tr>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">
              <p style="margin-bottom:0;">Available in: <strong>Professional</strong>, <strong>Enterprise</strong>, <strong>Performance</strong>,
                <strong>Unlimited</strong>, all <strong>Agentforce 1 Editions</strong>, and <strong>Developer</strong>
                Editions
              </p>
            </td>

          </tr>
        </tbody>
      </table> <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d124320e84">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d124320e84 ">To modify My Domain and session security settings:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d124320e84 ">Customize Application</td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d124320e84 ">To modify CORS settings:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d124320e84 ">Modify All Data AND Customize Application</td>

          </tr>
        </tbody>
      </table>

## Before You Begin

1. Make sure that your external app supports inline frames (iframes).
2. Make sure that your external app is secure and uses HTTPS.
3. Make sure that third-party cookies are allowed in your external app and your users’ browsers.

## Configure Session Settings

Add the domain names of your external apps to the Trusted Domains allowlist in Session Settings.

1. From Setup, in the Quick Find box, enter Session Settings, and then select **Session Settings**.
2. In the Trusted Domains for Inline Frames section of the Session Settings Setup page, click **Add Domain**.
3. Enter the domain of an external app that will host your Lightning Out 2.0 app.
    
    Acceptable URI formats are example.com, https://example.com, and \*.example.com.
4. Select **Lightning Out** from the IFrame Type dropdown list.
5. Save your changes.
6. Repeat steps 2-5 for any other domains that will host your Lightning Out 2.0 app.

## Enable Third-Party Cookies

Make sure that cross-domain Salesforce session cookies are enabled.

1. From Setup, in the Quick Find box, enter My Domain, and then select **My Domain**.
2. In the Routing and Policies section, make sure that the “Require first-party use of Salesforce cookies” setting is deselected.

## Configure CORS Settings

Add the domain names of your external apps to the Cross-Origin Resource Sharing (CORS) allowlist.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_click-264-0-0-production-enus/5f7d9219-b7b1-4552-8891-f1aba9b289fc/images/icon_note.png)

Note

This step is required only if your external app uses the Lightning Out 2.0 UI Bridge access point for client-side authentication. If your external app uses its own server-side authentication flow to generate a Salesforce frontdoor URL, this step isn’t required. See [Set Up Authentication for Lightning Out 2.0](https://help.salesforce.com/s/articleView?id=platform.lightning_out_auth.htm&release=264.0.0&type=5 "For an external app to access components in a Lightning Out 2.0 app, the end user must be authenticated in Salesforce. The external app must also be authorized to access Salesforce resources. To set up authentication and authorization, implement an OAuth 2.0 flow and configure an External Client App (ECA) in your org. Then configure your external app to either call the Lightning Out 2.0 UI Bridge endpoint or the standard Salesforce UI Bridge endpoint. The call generates a frontdoor URL at run time, which is used to establish a Salesforce session for the Lightning Out 2.0 app.").

1. From Setup, in the Quick Find box, enter CORS, and then select **CORS**.
2. To add a domain to the CORS allowlist, click **New**.
3. For Origin URL Pattern, enter the domain of the external app that will host your Lightning Out 2.0 app.
    
    The origin URL pattern must include the HTTPS protocol and a domain name.
4. Repeat steps 2 and 3 for any other domains that will host your Lightning Out 2.0 app.
5. In the Cross-Origin Resource Sharing (CORS) Policy Settings section, click **Edit**.
6. Select **Enable CORS for OAuth endpoints**.
7. Save your changes.

#### See Also

- [Set Up Authentication for Lightning Out 2.0](https://help.salesforce.com/s/articleView?id=platform.lightning_out_auth.htm&release=264.0.0&type=5 "For an external app to access components in a Lightning Out 2.0 app, the end user must be authenticated in Salesforce. The external app must also be authorized to access Salesforce resources. To set up authentication and authorization, implement an OAuth 2.0 flow and configure an External Client App (ECA) in your org. Then configure your external app to either call the Lightning Out 2.0 UI Bridge endpoint or the standard Salesforce UI Bridge endpoint. The call generates a frontdoor URL at run time, which is used to establish a Salesforce session for the Lightning Out 2.0 app.")
- [Specify Trusted Domains for Inline Frames](https://help.salesforce.com/s/articleView?id=xcloud.security_clickjack_specify_iframe_trusted_domains.htm&type=5&language=en_US)
- [Configure Salesforce CORS Allowlist](https://help.salesforce.com/s/articleView?id=xcloud.extend_code_cors.htm&type=5&language=en_US)
- [Enable CORS for OAuth Endpoints](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_endpoints_cors.htm&type=5&language=en_US)