We’re excited to announce the General Availability of Lightning Out 2.0 – the next evolution of extending Salesforce experiences beyond the Platform. It’s now easier, faster, and more secure to bring your Lightning Web Components (LWCs) into any external, non-Salesforce app. From customer portals to partner sites to enterprise tools, Lightning Out 2.0 delivers Salesforce capabilities directly into the apps you’re already building.

What is Lightning Out 2.0?

Lightning Out 2.0 is Salesforce’s recommended way to run LWCs outside the Salesforce Platform. It lets you reuse the components you’ve already built and surface them directly inside external apps, without duplicating UI, business logic, or integration code. A component can live in both Salesforce and in a React or Angular app while securely connecting to the same underlying CRM data.

The result is flexibility for development teams and consistency for end users – all while making Salesforce an integrated part of your broader technology stack.

Why Lightning Out 2.0?

Lightning Out (Beta) has long empowered developers to embed Salesforce experiences into external apps, but it stayed tied to Aura components and early architecture. With Lightning Out 2.0, now Generally Available in the Winter ’26 release, we’ve re-imagined this capability using standards-based web components, built for today’s modern, open web.

Powered by Lightning Web Runtime (LWR), the new release is lighter, faster, and more secure. Because it’s based on open web standards, Lightning Out 2.0 works seamlessly across frameworks and environments. Whether you’re building in Angular, Vue, React, or plain JavaScript, you can embed LWCs into the native experience of your app. Just as importantly, security has been strengthened with more robust isolation and stricter cross-domain controls. For enterprises running at massive scale, the architecture is designed to keep up with high-traffic use cases without compromise.

How Lightning Out 2.0 works

At its core, Lightning Out 2.0 uses LWR to bootstrap and render LWCs in non-Salesforce environments. Developers can load a lightweight script, authenticate securely, and then initialize Salesforce components as if they were native to the host app.

Here’s a simple example of embedding an LWC in an external app:

On the host page, you can include the Lightning Out 2.0 JavaScript library and configure the lightning-out-application component. This component sets up the connection to Salesforce using a secure frontdoor-url, which establishes the session and authentication context for the embedded LWCs.

Components to be rendered are specified in the components attribute, allowing the host page to load one or multiple LWCs directly. Attributes such as styling and configuration can be passed declaratively in the host page, so embedded components can adopt the host app’s look and feel without compromising encapsulation. This architecture ensures that Salesforce components behave consistently, integrate seamlessly into any technology stack, and remain fully connected to underlying Salesforce data and services.

Why Lightning Out 2.0 uses iframes

Lightning Out 2.0 takes a new approach by loading Salesforce components inside iframes, forming a closed shadow DOM that isolates it from the host page’s CSS, JavaScript, and potential security threats. In Lightning Out (Beta), components ran directly on the host page, which left them exposed to malicious scripts and vulnerable to conflicts with the host’s CSS or JavaScript.

With iframe isolation, Salesforce components stay isolated from interference and are guaranteed to behave consistently. To allow intentional communication between the host page and the embedded components, Lightning Out 2.0 wraps custom events using window.postMessage(). From a developer perspective, events are still created and handled using the standard EventTarget and CustomEvent interfaces, making cross-iframe communication secure and predictable.

Roadmap ahead

With the GA release of Lightning Out 2.0, we’ve focused on delivering the most fundamental and critical capabilities: securely embedding LWCs into external applications with a modern, standards-based runtime.

We have more on the roadmap ahead; support for unauthenticated access through Experience Cloud sites and Aura component compatibility aren’t part of this initial release, but they’re in active development coming in post-GA releases. Because many of the base components rely on deep integrations with Aura, full base component support will follow once those dependencies are fully addressed. If your use case depends on OmniStudio-specific functionality, we recommend checking out Omni Out, which is designed for those use cases.

Extending Salesforce beyond the Platform

In today’s web, no customer builds with a single technology stack. Businesses rely on multiple frameworks across teams, and critical workflows often span Salesforce and other technologies. Lightning Out 2.0 builds on insights from years of Lightning Out (Beta), letting you reuse the LWCs you’ve already built and surface Salesforce data directly in external apps.

Lightning Out 2.0 enables teams to deliver consistent logic and a single source of truth across apps, reducing duplication while enabling more integrated experiences. Now Generally Available in Winter ’26, it’s the simplest way to extend Salesforce into the apps and surfaces that your business depends on.

Start exploring Lightning Out 2.0 today to bring Salesforce beyond the Platform into every app, workflow, and customer interaction that matters.

Resources

About the author

Alice Oh is a Director of Product at Salesforce building Lightning Web Runtime, Lightning Out, and other foundational UI frameworks that enable flexible and reusable app development experiences across the Salesforce ecosystem. In her free time, she bikes around the Bay Area in search of the flakiest croissants. You can follow and connect with her on LinkedIn.