---
schema_version: "1"
id: 81c4fa3c8dfc5141288e1d3a7cc8bb44eb41d5461d5a9c9306f13de276f005e2
title: Allow Guest Access
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/lightning-base-components/lightning-design-system/guides/aura/components/ltng/allowGuestAccess/ltng-allow-guest-access.md
canonical_url: https://developer.salesforce.com/docs/platform/lightning-component-reference/guide/ltng-allow-guest-access.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: d1d0604658a5d840f0b857fd4997fc6352c0ede688a38c7d7e96936731822128
products:
  - Lightning Component Reference
---
# Allow Guest Access

**`ltng:allowGuestAccess`**

Allows guest user access on an application.

**For Use In**

Lightning Out (Beta)

::::::tabset{tabs='["Develop", "Specifications"]'}

:::::tab

Add the `ltng:allowGuestAccess` interface to your Lightning Out dependency app to make it available to users without requiring them to authenticate with Salesforce. This interface lets you build your app with Lightning components, and deploy it anywhere and to anyone.

A Lightning Out dependency app with the `ltng:allowGuestAccess` interface can be used with Lightning Components for Visualforce and with Lightning Out.

- Using Lightning Components for Visualforce, you can add your Lightning app to a Visualforce page, and then use that page in Salesforce Tabs + Visualforce sites. Then you can allow public access to that page.
- Using Lightning Out, you can deploy your Lightning app anywhere Lightning Out is supported—which is almost anywhere!

The `ltng:allowGuestAccess` interface is only usable in orgs that have Digital Experiences enabled, and your Lightning Out app is associated with all Experience Cloud site endpoints that you’ve defined in your org. Experience Cloud sites include sites built using Experience Builder and Visualforce.

When you add the `ltng:allowGuestAccess` interface to a Lightning app, the app is open to guest users and is available through _every_ Experience Builder site in your org, whether that site is enabled for public access or not. You can’t prevent it from being accessible via site URLs, and you can’t make it available for some sites but not others.

Be extremely careful about apps you open for guest access. Apps enabled for guest access bypass the object- and field-level security (FLS) you set for your Experience Cloud site’s guest user profile. Lightning components don’t automatically enforce CRUD and FLS when you reference objects or retrieve the objects from an Apex controller. This means that the framework continues to display records and fields for which users don’t have CRUD access and FLS visibility. You must manually enforce CRUD and FLS in your Apex controllers. A mistake in code used in an app enabled for guest access can open your org’s data to the world.

## Usage

First, add the `ltng:allowGuestAccess` interface to your Lightning Out dependency app.

For example:

```xml
<aura:application access="GLOBAL" extends="ltng:outApp"
    implements="ltng:allowGuestAccess">
    <aura:dependency resource="c:storeLocatorMain"/>
</aura:application>
```

You can only add the `ltng:allowGuestAccess` interface to Lightning apps, not to individual components.

Next, add the Lightning Out JavaScript library to your page.

- With Lightning Components for Visualforce, simply add the `<apex:includeLightning />` tag anywhere on your page.
- With Lightning Out, add a `<script>` tag that references the library directly, using a Experience Cloud site endpoint URL. For example:

```xml
<script src="https://yourExperienceDomain/experienceURL/lightning/lightning.out.js"></script>
```

A sample URL for the JavaScript library is `https://universalcontainers.force.com/ourstores/lightning/lightning.out.js`

Finally, add the JavaScript code to load and activate your Lightning app. This code is standard Lightning Out, with the important addition that you must use one of your org’s Experience Cloud site URLs for the endpoint. The endpoint URL takes the form `https://yourExperienceDomain/experienceURL/`. The relevant line is emphasized in the following sample.

```html
<script>
  $Lightning.use(
    "c:locatorApp", // name of the Lightning app
    function () {
      // Callback once framework and app loaded
      $Lightning.createComponent(
        "c:storeLocatorMain", // top-level component of your app
        {}, // attributes to set on the component when created
        "lightningLocator", // the DOM location to insert the component
        function (cmp) {
          // callback when component is created and active on the page
        }
      );
    },
    "https://universalcontainers.force.com/ourstores/" // Experience Cloud site endpoint
  );
</script>
```

For more information, see the [Lightning Aura Components Developer Guide](https://developer.salesforce.com/docs/atlas.en-us.lightning.meta/lightning/lightning_out.htm).


:::::

:::::tab

![No specifications to show](https://developer.salesforce.com/media/no-specs.png)


:::::

::::::