---
schema_version: "1"
id: 10d67ed70abf6e7c1eea96812d22be1f028383e73f76020ffdad96cde0d9304f
title: Configure a JWT Bearer Flow
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/configure_oauth_jwt_flow_external_client_apps.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.configure_oauth_jwt_flow_external_client_apps.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 3f549cd5643e2ff1b3c55b9861d396c6d412e86eb8ae073b10ba7660d84ec17b
description: External client apps can support OAuth 2.0 JSON Web Token (JWT) bearer flows using the certificate field in the global OAuth settings file. A JWT flow authorizes servers to access data without interactively logging in each time the servers exchange information.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Configure a JWT Bearer Flow

External client apps can support OAuth 2.0 JSON Web Token (JWT) bearer flows using the certificate field in the global OAuth settings file. A JWT flow authorizes servers to access data without interactively logging in each time the servers exchange information.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Professional</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong> Editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d89258e49">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d89258e49 ">To configure an external client app for OAuth 2.0 JWT Bearer Flows</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d89258e49 ">View all External Client Apps, view their settings, and edit their policies</td>
          </tr>
        </tbody>
      </table>

To configure a JWT bearer flow, you must first have an external client app on your Salesforce org. See [Create an External Client App](https://help.salesforce.com/s/articleView?id=xcloud.create_a_local_external_client_app.htm&release=264.0.0&type=5 "Create an external client app in App Manager. Local external client apps are available only on the org where you create them. Packageable external client apps can be packaged for distribution to other orgs.").

1. To create an X.509 certificate, follow the steps in [OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_jwt_flow.htm&release=264.0.0&type=5 "Sometimes you want to authorize servers to access data without interactively logging in each time the servers exchange information. For these cases, you can use the OAuth 2.0 JSON Web Token (JWT) bearer flow. This flow uses a certificate to sign the JWT request and doesn’t require explicit user interaction. However, this flow does require prior approval of the client app.").
2. From Setup, in the Quick Find box, enter External Client Apps Manager, and then select **External Client Apps Manager**.
3. From the actions dropdown list for the external client app that you want to configure, select **Edit Settings**.
4. In the OAuth Settings section, select **Enable OAuth**.
5. Configure [basic OAuth settings](https://help.salesforce.com/s/articleView?id=xcloud.configure_external_client_app_oauth_settings.htm&release=264.0.0&type=5 "Configure the OAuth settings to set the structure of the local external client app.").
6. Select **Enable JWT Bearer Flow**.
7. Select **Upload Files** and then choose the X.509 certificate.
8. Save the settings.
9. Create a JWT by following the steps in [OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_jwt_flow.htm&release=264.0.0&type=5 "Sometimes you want to authorize servers to access data without interactively logging in each time the servers exchange information. For these cases, you can use the OAuth 2.0 JSON Web Token (JWT) bearer flow. This flow uses a certificate to sign the JWT request and doesn’t require explicit user interaction. However, this flow does require prior approval of the client app.").