Platform architects often spend weeks wrestling with authentication layers when they want to introduce a modern React frontend to their org. The core issue is that external React apps require manual OAuth flows, token refresh logic, and custom security wrappers that drift from Salesforce’s native permission model over time. This post targets those architects who need employee-facing dashboards or lightweight customer portals that still respect field-level security and Apex business rules.
The traditional path leads to either Lightning Web Components for everything or a fully external React application hosted outside the platform. Both options create friction. LWCs keep you inside the platform but limit your component library choices and force teams to abandon familiar React tooling. External hosting shifts the burden onto custom token management that breaks during org migrations or permission changes.
A lighter path exists through the Salesforce Platform SDK paired with Salesforce Multi-Framework. This combination lets architects deploy React applications that run on a dedicated salesforce.app domain while inheriting Salesforce authentication, CSRF protection, and governance automatically. No separate token handling is required because the runtime enforces the same permission sets that govern the rest of the org.
The Salesforce Platform SDK (@salesforce/platform-sdk) provides typed methods for GraphQL reads and writes plus direct Apex invocation. Queries use .query() while mutations use .mutate(), and results support optional chaining so developers avoid common null-reference errors that appeared during the beta phase. The same library exposes a fetch wrapper that reaches standard REST endpoints without additional headers.
Many architects start here because the approach reduces the surface area they must maintain. Instead of writing and securing an OAuth client, they focus on component logic and business requirements. The apps deploy as UI Bundles referenced by Custom Application metadata, which means visibility is controlled through the same permission sets used for other Salesforce features.
Current state of React development on Salesforce
Most platform teams still default to Lightning Web Components when they need custom interfaces. That choice works for simple extensions but creates friction once teams want to reuse existing React component libraries or adopt modern state management patterns. External React apps solve the tooling problem yet introduce new operational work around token rotation, domain allowlisting, and keeping user context in sync with Salesforce sessions.
The gap widened as organizations adopted Agentforce for conversational experiences. Architects needed a way to embed or launch React surfaces that could call the same agents and Apex actions without rebuilding authentication each time. The July 2026 general availability of Salesforce Multi-Framework on Hyperforce orgs closed that gap for React first, with Angular support listed on the roadmap.
Why the lighter Multi-Framework approach often wins
Heavy custom builds require ongoing investment in security reviews, token libraries, and deployment pipelines that sit outside Salesforce DX. The Platform SDK removes that layer by running inside the platform’s trust boundary. Architects keep ownership of their React code while the runtime handles session management and enforces the same field-level security that protects standard objects.
This matters when teams need to iterate quickly. A dashboard that previously took three weeks of OAuth plumbing can reach production in days once the app uses the built-in .query() and Apex call patterns. The salesforce.app domain also satisfies Same Origin Policy isolation without extra configuration, which satisfies many internal security teams that previously blocked external hosting.
The approach stays practical because it does not claim to replace every use case. It targets employee-facing Custom Applications today and customer-facing Experience targets in future releases. Architects who need deep customization of the hosting layer or support for frameworks outside the current React focus will still evaluate heavier options.
How the Platform SDK works in practice
An architect begins by confirming the org runs Summer ’26 or later on Hyperforce. They enable the React Development with Salesforce Multi-Framework setting in Setup, then install the Platform SDK into an existing React project. Components call GraphQL through the SDK’s typed methods and pass context from UI APIs to determine the current user and their permissions.
Deployment packages the React build as a UI Bundle. A Custom Application metadata file references that bundle and defines which profiles or permission sets can see it. The result appears in the App Launcher exactly like any other Salesforce application, yet the underlying code runs modern React with full access to hooks and third-party libraries.
Common patterns include employee dashboards that pull live data through GraphQL, then trigger Apex methods for complex calculations. Customer-facing versions follow the same structure but target Experience Cloud sites once that capability reaches general availability. The same codebase can later incorporate Agentforce agents through the documented APIs without changing the authentication layer.
Practical steps to get started
Confirm your org meets the Summer ’26 Hyperforce requirement and locate the enablement toggle in Setup. Create or update a React application and add the @salesforce/platform-sdk package. Replace any existing data-fetch logic with the SDK’s .query() and .mutate() calls, then test Apex invocation through the provided fetch wrapper.
Package the build output as a UI Bundle and create the Custom Application metadata file that points to it. Assign the application through permission sets rather than profiles to keep access granular. Deploy through Salesforce CLI or your existing CI pipeline and verify the application appears under the expected domain.
Teams that already maintain React codebases can usually migrate the data layer in a single sprint. The main effort shifts from security plumbing to mapping existing components onto the Salesforce data model and Apex actions.
Decision Framework: when the light approach fits versus heavier builds
Choose the Platform SDK and Multi-Framework when your primary goal is employee-facing React interfaces that must respect existing Salesforce permissions and you want to avoid maintaining separate OAuth infrastructure. The approach also suits teams that already have React expertise and need to deliver within the next quarter without expanding the security review backlog.
A heavier custom build becomes warranted when you require Angular or another framework not yet supported, need micro-frontend composition across multiple independent teams, or must host the application on infrastructure outside Hyperforce for regulatory reasons. In those cases the added operational overhead of custom token management and separate deployment pipelines is justified by the specific constraints.
The honest limitation today is that full micro-frontend support and managed package distribution remain on the roadmap. Architects planning large-scale portal replacements should verify current capabilities against their timeline rather than assuming every future feature is already available.
Read Next
How Do SF Platform Architects Build Headless Salesforce Experiences with Multiple Frameworks?
SF Platform Architects build headless Salesforce experiences by exposing core data through APIs and composing frontends from React, LWC, Vue and more—without framework lock-in.
How Do SF Platform Architects Implement Salesforce Micro Frontends Without Framework Lock-In?
SF Platform Architects implement Salesforce micro frontends with Multi-Framework and MFE Developer Preview using sandboxed iframes and the Platform SDK to avoid framework lock-in.
Decouple Salesforce Frontend: Replace Experience Cloud with Your Own React Stack
Solution architects and Salesforce admins can now run full React apps natively on the platform. Learn how Multi-Framework removes Experience Cloud constraints while keeping data, security, and governance inside Salesforce.
