For Salesforce administrators

Salesforce requirements for FlowRunner

Everything your Salesforce org and users need to run FlowRunner — the edition, the user license, the per-user permissions, and the org-level settings. Start with the setup checklist; the license and edition detail below is for evaluators deciding what their team needs to buy.

Verified against the Salesforce Summer '26 release. FlowRunner uses Lightning Out 2.0 to run your Flows.

Setup checklist

To run FlowRunner, each user needs an API-enabled Salesforce login with permission to run Flows, the FlowRunner User permission set, and access to whatever objects your Flows use. Your org needs My Domain on, the managed package installed, and cross-origin cookies allowed. Everything below expands these.

For each user

A Salesforce license that can reach the objects your Flows use
API Enabled permission
Run Flows permission (or the Flow User checkbox)
The FlowRunner User permission set assigned
Read/edit on the objects the Flows touch (CRUD & field-level security)
Not an "API Only User" — that blocks the session bridge

For the org (admin, once)

My Domain enabled
The FlowRunner managed package installed
External Client App approved (set to "Admin Pre-approved")
"Complete Setup" run in the admin panel (applies iframe + session settings)
End users' browsers allow cross-origin cookies

New to setup? The install guide walks through package install, the External Client App, and the permission set in order.

Per-user permissions

Each FlowRunner user needs three Salesforce permissions plus access to the objects their Flows use: API Enabled (for the API calls FlowRunner makes), Run Flows (to execute Screen Flows), and the FlowRunner User permission set. A user marked "API Only User" cannot use FlowRunner at all.

API Enabled: FlowRunner reads and writes through the Salesforce REST API on each user's behalf (record lookup, search, inline edits), so every user needs API access. Included in Enterprise, Unlimited, Performance, Developer, and Platform licenses; Professional Edition needs the API add-on.
Run Flows: Required to execute Screen Flows. Grant it on a profile or permission set, or enable the Flow User checkbox on the user record. Salesforce began enforcing this in Winter '26, so it can no longer be assumed.
FlowRunner User permission set: Created during setup (not shipped inside the managed package). It pre-approves FlowRunner's External Client App for the user and grants the custom permission that gates the FlowRunner component. Assign it both to the External Client App and to each end user. See the install guide.
Object & field access: Flows run as the user, so each user needs read/edit (CRUD and field-level security) on the objects their Flows touch. FlowRunner enforces the user's own access — it never elevates permissions — so under-permissioned users simply see fewer records.
Not an "API Only User": Lightning Out 2.0 establishes a web session for the user. The "API Only User" permission blocks web sessions, so such users cannot run FlowRunner.

Org prerequisites

At the org level FlowRunner needs My Domain enabled, the managed package installed, the External Client App approved, and the one-time "Complete Setup" step that applies the iframe and session settings. End users also need cross-origin cookies allowed in their browser, because the Flow renders in an iframe.

My Domain — required for the Lightning Out 2.0 session bridge (the secure single-use URL is My Domain–scoped).
Managed package — install FlowRunner from the AppExchange and connect the org in the admin panel.
Cross-origin cookies — Lightning Out 2.0 runs in an iframe and needs third-party cookies. On Outlook for Mac with Safari tracking prevention, FlowRunner falls back to a legacy renderer automatically.
Complete Setup — one click in the admin panel applies the iframe allowlist and session settings the embed needs.

Supported editions

FlowRunner works on Enterprise, Unlimited, Performance, and Developer Editions, which include API access. Professional Edition works only with the paid Web Services API add-on, because FlowRunner relies on the Salesforce API for every action. Group, Essentials, and Personal Editions are not supported.

Edition	Supported?	Note
Enterprise, Unlimited, Performance, Developer	Yes	API access included
Professional	With API add-on	PE has no API access by default — add the Web Services API. Based on Salesforce documentation.
Group, Essentials, Personal	No	No API / Flow-runtime support

User license tiers

A Salesforce Platform license is enough when your Flows use Accounts, Contacts, Activities, and custom objects. Flows that touch Leads, Opportunities, Campaigns, or Service Cloud Case features need a full Salesforce (CRM) license, because Platform licenses cannot reach those standard objects. The minimum license depends on what your Flows do.

Object used by your Flow	Salesforce Platform	Full Salesforce (CRM)
Account, Contact, Activities, custom objects	Yes	Yes
Lead, Opportunity, Campaign	No	Yes
Case (Service Cloud features)	No	Yes

Verification status. Verified end-to-end: a Salesforce Platform–licensed user can run FlowRunner via Lightning Out 2.0 for flows touching Account, Contact, Activities, and custom objects. Flows touching Lead, Opportunity, Campaign, or Case still require a full Salesforce license, as noted above.

Source: Salesforce, Lightning Platform / Salesforce Platform license features (accessed June 2026).

FAQ

Do my users need full Salesforce licenses to use FlowRunner?

Not necessarily. A Salesforce Platform license (Lightning Platform Starter or Plus) is enough when your Flows and lookups use Accounts, Contacts, Activities, and custom objects. Flows that read or write Leads, Opportunities, Campaigns, or Service Cloud Case features require a full Salesforce (CRM) license, because Platform licenses cannot access those standard objects.

What is the Run Flows permission and who needs it?

Run Flows is the Salesforce permission that lets a user execute Screen Flows. Every FlowRunner end user needs it, granted through a profile or permission set (or the legacy Flow User checkbox on the user record). Since the Winter '26 release, Salesforce enforces this explicitly, so it can no longer be assumed.

Why does FlowRunner need third-party cookies?

FlowRunner renders your Flow inside an iframe using Salesforce Lightning Out 2.0, which establishes a Salesforce session across origins. That requires the user's browser to allow cross-origin (third-party) cookies. On browsers that block them, such as Outlook for Mac with Safari tracking prevention, FlowRunner falls back to a legacy renderer.

What does the FlowRunner User permission set grant?

The FlowRunner User permission set is created during setup, not shipped inside the managed package. It pre-approves FlowRunner's External Client App for the user and grants the custom permission that gates the FlowRunner component. The admin assigns it both to the External Client App and to each end user.

Does FlowRunner work with Salesforce Professional Edition?

Only with the paid Web Services API add-on. FlowRunner relies on the Salesforce REST API for every action, and Professional Edition does not include API access by default. Enterprise, Unlimited, Performance, and Developer Editions include API access. This claim is based on Salesforce documentation.