---
schema_version: "1"
id: be30d5e6a360fec376df92855c215b511e926f7671c2538f981fb0e16207df2c
title: Configure the External Client App OAuth Settings
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/configure_external_client_app_oauth_settings.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.configure_external_client_app_oauth_settings.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: ce1fc56f527e1fd10e714eb78c22a14d6cbcae61f6e5a7383264fbac273f4623
description: Configure the OAuth settings to set the structure of the local external client app.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Configure the External Client App OAuth Settings

Configure the OAuth settings to set the structure of the local external client app.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Professional</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong> Editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d12573e49">User Permissions
              Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d12573e49 ">To configure External Client Apps OAuth settings</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d12573e49 ">Create, edit, and delete External Client Apps</td>
          </tr>
        </tbody>
      </table>

1. Create your external client app, and complete its basic information.
2. In the OAuth Settings area of the page, select **Enable OAuth**.
    
    The OAuth Settings area expands and the OAuth settings fields are visible.
3. Enter the callback URL (endpoint) that Salesforce calls back to your application during OAuth. It’s the same as the OAuth redirect URI.
    
    Depending on which OAuth flow you use, the URL is typically the one that a user’s browser is redirected to after successful authorization. Because this URL is used by some OAuth flows to pass an access token, the URL must use secure HTTPS or a custom URI scheme. If you enter multiple callback URLs, at run time Salesforce matches the callback URL value specified by the app with one of the values in Callback URL. It must match one of the values to pass validation.
    
    The Callback URL field has a limit of 2000 characters, cumulatively. Separate multiple callback URLs with line breaks.
4. Select the OAuth scopes to apply to the external client app.
    
    OAuth scopes define permissions for the external client app, which are granted as tokens after the app is authorized. The OAuth token name is in parentheses.
5. To authorize a single external client app to introspect all access and refresh tokens within the entire org, select **Introspect all Tokens**.
    
    By default, all external client apps can introspect their own tokens. In addition, an OAuth client that directly registers OAuth 2.0 external client apps through the dynamic client registration endpoint can check the tokens for itself and its registered apps.
6. To control how the OAuth request handles the ID token, select **Configure ID token**.
    
    If the OAuth request includes the **Allow access to your unique identifier (openid)** scope, the returned token can include the ID token.
    
    The ID token is always included in access token responses.
7. With the primary ID token setting enabled, configure the secondary settings that control the ID token contents in both access and refresh token responses. Specify these settings.
    
     
    | Setting | Description |
    | --- | --- |
    | **Token duration in minutes** | The length of time that the ID token is valid for after it’s issued. The period can be from 1 to 720 minutes. The default is 2 minutes. |
    | **ID Token Audiences** | The intended consumers of the ID token. For example, the target service where you use the ID token, such as https://your\_service.com. |
    | **Include Standard Claims** | Include the standard claims that contain information about the user, such as the user’s name, profile, phone number, and address. The OpenID Connect specifications define a set of standard claims to be returned in the ID token. |
    | **Include Custom Permissions** | If your app has specified custom permission, include them in the ID token. |
    | **Custom Attributes** | If your app has specified custom attributes, include them in the ID token. |
8. Enable an OAuth flow, and configure these settings, as needed.
    
    <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small "><tbody><tr class=""><th style="vertical-align:top;" headers="d12573e157-option" id="d12573e159">Configure settings for the client credentials flow</th><td style="vertical-align:top;" headers="d12573e157-desc d12573e159">See <a href="https://help.salesforce.com/s/articleView?id=xcloud.configure_client_credentials_flow_for_external_client_apps.htm&amp;release=264.0.0&amp;type=5" title="To share information between two applications without any input from a user, use the OAuth 2.0 client credentials flow. In this flow, the client app exchanges its client credentials that are defined in the external client app for an access token. For this flow, you must specify an integration user to run the integration.">Configure a Client Credentials Flow</a></td></tr><tr class=""><th style="vertical-align:top;" headers="d12573e157-option" id="d12573e170">Configure settings for the Authorization Code and Credentials Flow</th><td style="vertical-align:top;" headers="d12573e157-desc d12573e170">See <a href="https://help.salesforce.com/s/articleView?id=xcloud.configure_oauth_code_credentials_flow_external_client_apps.htm&amp;release=264.0.0&amp;type=5" title="The Code and Credentials Flow is the foundation of headless login, registration, passwordless login, and guest user identity. Before setting up these features, enable the Code and Credentials Flow at an org-wide level and configure these required settings and access policies for your external client app.">Configure a Code and Credentials Flow</a>.</td></tr><tr class=""><th style="vertical-align:top;" headers="d12573e157-option" id="d12573e182">Configure settings for a device flow</th><td style="vertical-align:top;" headers="d12573e157-desc d12573e182">See <a href="https://help.salesforce.com/s/articleView?id=xcloud.configure_device_flow_external_client_apps.htm&amp;release=264.0.0&amp;type=5" title="To integrate apps that run on devices with limited input or display capabilities, such as smart TVs, appliances, and other internet of things (IoT) devices, configure the Global OAuth Settings to include a device code, and enable the OAuth 2.0 device flow. Command-line apps can use this flow as well. Users can connect these apps to Salesforce by accessing a browser on a device with more advanced input capabilities, such as a desktop or mobile device.">Configure a Device Flow</a></td></tr><tr class=""><th style="vertical-align:top;" headers="d12573e157-option" id="d12573e193">Configure JSON Web Token (JWT)-based access tokens</th><td style="vertical-align:top;" headers="d12573e157-desc d12573e193">See <a href="https://help.salesforce.com/s/articleView?id=xcloud.configure_oauth_jwt_flow_external_client_apps.htm&amp;release=264.0.0&amp;type=5" title="External client apps can support OAuth 2.0 JSON Web Token (JWT) bearer flows using the certificate field in the global OAuth settings file. A JWT flow authorizes servers to access data without interactively logging in each time the servers exchange information.">Configure a JWT Bearer Flow</a></td></tr></tbody></table>
9. To require the app’s client secret in exchange for an access token, select **Require Secret for the Web Server Flow**.
    
    ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_important.png)
    
    Important If the client app can’t keep the client secret confidential and must use the web server flow, deselect **Require Secret for Web Server Flow**. We still generate a client secret for your app, but this setting instructs the web server flow not to require the client\_secret parameter in the access token request.
10. To require the client secret in the authorization request of a refresh token and hybrid refresh token flow, select **Require Secret for Refresh Token Flow**.
    
    If you don’t select this option and an app sends the client secret in the authorization request, Salesforce still validates it.
    
    You can select this option for web-server based apps that can protect client secrets. But for apps that can’t protect client secrets, such as mobile apps or apps installed on a user’s computer, we recommend against selecting this option.
11. To require PKCE, select **Require Proof Key for Code Exchange (PKCE) extension for Supported Authorization Flows**.
    
    This setting requires PKCE for the web server flow, the hybrid web server flow, and the Code and Credentials flow. It also requires PKCE for all variations of the Code and Credentials flow including headless registration, headless passwordless login, and headless identity for guest users. With this setting enabled, any of these flows that don’t implement PKCE are blocked for this external client app. For more information on using PKCE to secure your apps, see [Proof Key for Code Exchange (PKCE) Extension](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_pkce.htm&release=264.0.0&type=5 "To improve the security of your OAuth and authentication provider implementations, use the OAuth 2.0 Proof Key for Code Exchange (PKCE) extension. You can require PKCE at an org-wide level, require it for a specific connected app, and automatically enable it for supported authentication providers.").
12. To get a new refresh token each time the refresh token flow is invoked, select **Enable Refresh Token Rotation**.
    
    ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_important.png)
    
    Important Enabling this setting is a security best practice. With this setting enabled, the old refresh token is automatically invalidated after it’s used, so that each token is used only one time. If someone tries to use a refresh token that’s been rotated out, Salesforce invalidates the current refresh token and any associated access tokens.
13. To get access tokens for users, select **Issue JSON Web Token (JWT)-based access tokens for named users**.
14. After you configure the settings for your external client app, save your changes.

- **[Set IP Allowlist Ranges for Refresh Tokens](https://help.salesforce.com/s/articleView?id=xcloud.set_ip_allowlist_for_refresh_tokens.htm&release=264.0.0&type=5)**  
    To improve security and help protect your Salesforce data from unauthorized access, set an IP range to allow refresh tokens. When you turn on Enforce Refresh Token IP Allowlist, only IPs in allowed ranges can complete the OAuth web server flow or the refresh token flow.
- **[Limit the Idle Refresh Token TTL in External Client Apps](https://help.salesforce.com/s/articleView?id=xcloud.eca_limit_idle_refresh_token_ttl.htm&release=264.0.0&type=5)**  
    For improved security, Salesforce requires a 30-day limit to the idle refresh token TTL (time-to-live). The idle TTL is the amount of time that an OAuth refresh token can be inactive before it expires. When a refresh token expires, the user or app must request a new access token. The idle TTL works as a sliding window: each time the token is used within the 30 day-period, its idle TTL resets. For flows that don't use refresh tokens, this control also caps the access token lifetime at 30 days from the last login date.