Immediate Question: Is there a way to use authenticated Lightning Out with another Salesforce Org?

We've currently got two Salesforce Orgs: Org A and Org B In Org A, we've created a flow that allows users to create cases against account records, and flow consists of dynamic flow screens. Now, we want that same flow to be used in Org B, that would allow the users from Org B to create cases and associate them with accounts in Org A.

Upfront, we could replicate the flows in Org B(packaged), and setup apex rest api callouts that would allow it to create cases in Org A. But the problem with that is we're going to be maintaining logic from two different orgs. Another alternative would be creating a community from Org A, expose the flow in the community, create community users for Org B, problem with this is that neither Org A and Org B want to cover the cost for the community licenses.

After looking for alternatives, I stumbled upon Lightning Out, which allows you to expose a component onto another web container. So I was thinking of using Org B as the web container for the app that we're building from Org A.

This looks easy if we're just going to be sharing the app as unauthenticated. But we want it to be authenticated for security reasons, because CORS whitelisting is not enough as a security control to prevent the app from being used from other domains.

So going down the path of Lightning Out Authentication, there's two ways of authenticating in Lightning Out

There are two supported ways to obtain an authentication token for use with Lightning Out.

  • On a Visualforce page, using Lightning Components for Visualforce, you can obtain the current Visualforce session ID using the expression {! $Api.Session_ID }. Sessions initiated using the session ID are intended for use only on Visualforce pages.
  • Elsewhere, an authenticated session is obtained using OAuth, following the same process you’d use to obtain an authenticated session to use with the REST API. In this case, you obtain an OAuth token, and can use it anywhere.

Obviously the first one isn't applicable, given that it would only work if you're showing the component in the same org using a visualforce page.

Looking at the second one, it looks straight forward at first(ref. Salesforce to Salesforce Integration):

  1. Create a Connected app from Org A
  2. Create an Authentication Provider from Org B (Salesforce using the Connected App from Org A)
  3. Create a Named Credentials from Org B that uses Org A as an endpoint, and uses Named Principal(Integration User), OAuth, and Auth Provider from step 2.

But this is where I got stuck, I can use the named credentials in Apex to execute callouts to Org A. But I couldn't pass the Oauth Token from my Named Credentials back to client side on my VFpage in org B to render my Lightning Out app

$Lightning.use() takes an oauth token or session id on the fourth argument


<apex:page showHeader="false">        
  <apex:includeLightning />
        <div id="lightning" />
        $Lightning.use("c:testApp",    // name of the Lightning app
                       function() {                  // Callback oncruue framework and app loaded
                               "c:auraFlow", // top-level component of your app
                               { },                  // attributes to set on the component when created
                               "lightning",   // the DOM location to insert the component
                               function(cmp) {
                                   console.log('component created');
                                   // callback when component is created and active on the page
                       'https://dx-lightningout.cs115.force.com/out',// Community endpoint


  • Is there a way to pass the oauthtoken/sessionId from Named Credentials to Client side(vfp) for Lightning Out?
  • Can Lightning Out be used with another Salesforce org?
  • Should I be even doing this, or just go down the path of using a packaged app installed in Org B with the App, Auth Provider, and Named Credentials?

2 Answers 2


You can't get the access token from Named Credential, it acts as a runtime proxy. Once initialized, Auth Provider can give you the token via AuthToken.getAccessToken(authProviderId, authProviderName)(docs). To obtain the auth provider ID and name you can look at its entry/details screen via the admin console. You can call this method in your server-side controller backing the VF page and get the token. From there, you can send it to your VF page in the usual manner.

  • what do you mean by "Once initialized"? problem with this is that we have to use an integration user in Org A for Org B to be able to authenticate, given that no users from Org B are users in Org A.
    – sfdx
    Sep 1, 2020 at 23:48
  • 1
    "Once initialized" refers to a sequence of calls on auth provider that will result in oAuth flow with the access token acquired at the end of the flow. You can kick off the sequence programmatically. What's the problem with using an integration user?
    – identigral
    Sep 2, 2020 at 0:18
  • that kind of worked. the problem is users from Org B would have to authenticate using the integration user in the oauthflow, meaning we have to share credentials to those users. Or does the token doesn't get expired once authorized?
    – sfdx
    Sep 2, 2020 at 2:53
  • You only need org A. The authorization of a client in oAuth is against the org hosting the connected app (org A) and users in that org. You can use the access token obtained via that sequence to call org B, incl. Lightning Out. See this answer for the explanation.
    – identigral
    Sep 2, 2020 at 8:05
  • yes, sorry I understand how connected app works, I just didn't explain it clearly in my answer. What I meant was, users from Org B has to authenticate as the integration user in Org A to be able to get an oAuth token. Is that going to be a once-off thing? or do they have to authenticate everytime the token expires?
    – sfdx
    Sep 2, 2020 at 20:47

Here are a couple of options:

  1. use a connected app to authenticate + APEX in org A to authenticate and use the flow in org B. The downside for this option is (1) flow UI screens cannot be re-used and (2) this option is best for auto-launched flows only enter image description here

  2. use Canvas

enter image description here

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .