---
schema_version: "1"
id: 6d3c85da8350c1319a05812c2c339fa303d7002978d3bb3b365299a9fa828954
title: Configure a Code and Credentials Flow
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/configure_oauth_code_credentials_flow_external_client_apps.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.configure_oauth_code_credentials_flow_external_client_apps.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 39a9bbe3fed78fc65fbd71413c270f737b185a12f90e68c2cc519befa3cf56f2
description: The Code and Credentials Flow is the foundation of headless login, registration, passwordless login, and guest user identity. Before setting up these features, enable the Code and Credentials Flow at an org-wide level and configure these required settings and access policies for your external client app.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Configure a Code and Credentials Flow

The Code and Credentials Flow is the foundation of headless login, registration, passwordless login, and guest user identity. Before setting up these features, enable the Code and Credentials Flow at an org-wide level and configure these required settings and access policies for your external client app.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Professional</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong> Editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d58278e49">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d58278e49 ">To configure an External Client App for OAuth 2.0 Code and Credentials Flows</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d58278e49 ">Create, edit, and delete External Client Apps</td>
          </tr>
        </tbody>
      </table>

1. To access the Code and Credentials Flow settings, allow external client apps to access the flow.
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)
    
    Note By default, the Code and Credentials Flow is blocked for all external client apps.
    
    1. From Setup, in the Quick Find box, enter OAuth, and then select **OAuth and OpenID Connect Settings**.
    2. Turn on **Allow Authorization Code and Credentials Flows**.
2. Create your external client app and complete its [basic information](https://help.salesforce.com/s/articleView?id=xcloud.create_a_local_external_client_app.htm&release=264.0.0&type=5 "Create an external client app in App Manager. Local external client apps are available only on the org where you create them. Packageable external client apps can be packaged for distribution to other orgs.").
3. Set up the basic [OAuth settings](https://help.salesforce.com/s/articleView?id=xcloud.enable_oauth_plugin.htm&release=264.0.0&type=5 "In an external client app, configurations are divided between settings and policies for each plugin. To add an external client app plugin, enable the plugin and configure the settings.") for the app, including these settings.
    1. Enable OAuth.
    2. Enter a callback URL.
    3. Assign scopes to the app.
4. Configure these specific settings for the Authorization Code and Credentials Flow.
    1. (Optional) To require the Proof Key for Code Exchange (PKCE) extension for your flow, select **Require Proof Key for Code Exchange (PKCE) Extension for Supported Authorization Flows**.
        
        With this setting selected, you must implement PKCE when you build your flow. We strongly recommend PKCE for public clients, because these apps can’t use the consumer secret to protect the code exchange. We also recommend it for private clients, but it’s less critical.
    2. Select **Enable Authorization Code and Credentials Flow**.
    3. (Optional) To require your third-party client app to send the user’s credentials in the body of HTTP POST requests to the authorization endpoint, select **Require user credentials in the POST body for Authorization Code and Credentials Flow**.
        
        With this setting enabled, you can’t use the GET method for the authorization request, and you can’t include user credentials in a Basic authorization header.
    4. If you’re using a client backend to implement this flow for a private client, select **Require Secret For Web Server Flow** and **Require Secret for Refresh Token Flow**.
        
        Ensure that your client back end can keep the consumer secret secure.
    5. If you’re using this flow for a public client, deselect **Require Secret For Web Server Flow** and **Require Secret for Refresh Token Flow** to avoid exposing the consumer secret to the browser.
    6. Save your settings.