---
schema_version: "1"
id: cb112cdfc8f5e270b581f60bcf1f5f796dfd5f6ca90073fd2748bd526c8e11db
title: Configure a Connected App for the OAuth 2.0 Client Credentials Flow
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/connected_app_client_credentials_setup.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.connected_app_client_credentials_setup.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 7924194ac1e92ed5c1e1fdb452a05d25abaa2fab28b3fede5d61d5582250359c
description: With the OAuth 2.0 client credentials flow, your client app exchanges its client credentials defined in the connected app—its consumer key and consumer secret—for an access token. Before you implement the client credentials flow, configure these settings and access policies for your connected app.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Configure a Connected App for the OAuth 2.0 Client Credentials Flow

With the OAuth 2.0 client credentials flow, your client app exchanges its client credentials defined in the connected app—its consumer key and consumer secret—for an access token. Before you implement the client credentials flow, configure these settings and access policies for your connected app.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
        <colgroup>
          <col>
        </colgroup>
        <tbody>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and
              Lightning Experience</td>
          </tr>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">
              <p>Connected Apps can be created in: <strong>Group</strong>, <strong>Essentials</strong>,
                <strong>Professional</strong>, <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and
                <strong>Developer</strong> Editions
              </p>
              <p style="margin-bottom:0;">Connected Apps can be installed in: All editions</p>
            </td>
          </tr>
        </tbody>
      </table> <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d22543e61">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d22543e61 ">To read, create, update, or delete connected apps:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d22543e61 ">
              <p>Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data OR Manage Connected
                Apps</p>
            </td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d22543e61 ">To update all fields except Profiles, Permission Sets, and Service Provider SAML
              Attributes:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d22543e61 ">
              <p>Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data OR Manage Connected
                Apps</p>
            </td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d22543e61 ">To update Profiles, Permission Sets, and Service Provider SAML Attributes:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d22543e61 ">Customize Application AND Modify All Data AND Manage Profiles and Permission
              Sets</td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d22543e61 ">To rotate the consumer key and consumer secret:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d22543e61 ">Allow consumer key and secret rotation</td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d22543e61 ">To install and uninstall connected apps:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d22543e61 ">
              <p>Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data OR Manage Connected
                Apps</p>
            </td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d22543e61 ">To install and uninstall packaged connected apps:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d22543e61 ">
              <p>Download AppExchange Packages AND Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data
                OR Manage Connected Apps</p>
            </td>
          </tr>
        </tbody>
      </table>

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)

Note Connected apps creation is restricted as of Spring ‘26. You can continue to use existing connected apps during and after Spring ‘26. However, we recommend using [external client apps](https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps.htm&language=en_US) instead. If you must continue creating connected apps, contact Salesforce Support.

See [New connected apps can no longer be created in Spring ‘26](https://help.salesforce.com/s/articleView?id=005228017&type=1&language=en_US) for more details.

![Warning](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_warning.png)

Warning Before you set up the client credentials flow, it’s important to understand its security risks. With this flow enabled, any person or app that has access to your connected app’s consumer key and consumer secret can get an access token. Maintain security by periodically changing your consumer secret, and change it immediately if it becomes compromised. See [Rotate the Consumer Key and Consumer Secret of a Connected App](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_rotate_consumer_details.htm&type=5&language=en_US).

For connected apps installed as part of a managed package, keep these considerations in mind.

- The developer that set up the connected app in the publishing org can get an access token for subscriber orgs.
- When the client credentials flow is enabled on a connected app in the publishing org, it isn’t automatically enabled in the subscriber org. Subscribers must explicitly opt in to use the flow.
- When the client credentials flow isn’t enabled in the publishing org, subscribers can’t enable it for their installed app.

1. Create your connected app, and complete its [basic information](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create_basics.htm&release=264.0.0&type=5 "For all connected apps, define the basics, which include the app’s name, logo, and contact information.").
2. Configure the necessary [OAuth settings](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create_api_integration.htm&release=264.0.0&type=5 "You can use a connected app to request access to Salesforce data on the behalf of an external application. For a connected app to request access, it must be integrated with the Salesforce API using the OAuth 2.0 protocol. OAuth 2.0 is an open protocol that authorizes secure data sharing between applications through the exchange of tokens. When developers or independent software vendors (ISV) want to integrate their app with Salesforce, they use OAuth APIs. These OAuth APIs enable a user to work in one app but see the data from another.") for the connected app.
3. Enable the client credentials flow for your connected app.
    1. From Setup, in the Quick Find box, enter Apps, and then select **App Manager**.
    2. Find your connected app, click ![Action dropdown](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/resources-global/_corporate/images/dropdown.png), and then select **Edit**.
    3. Under API (Enable OAuth Settings), select **Enable Client Credentials Flow**.
    4. When you understand the security risks, accept the warning.
    5. Save your changes.
4. Select an execution user for the flow.
    
    Although there’s no user interaction in the client credentials flow, Salesforce still requires you to specify an execution user. By selecting an execution user, you allow Salesforce to return access tokens on behalf of this user.
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)
    
    Note Permitted Users policies, such as **All users may self-authorize** and **Admin approved users are pre-authorized**, don’t apply to the execution user.
    
    1. From the connected app detail page, click **Manage**.
    2. Click **Edit Policies**.
    3. Under Client Credentials Flow, for Run As, click ![Magnifying glass icon](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/resources-global/_corporate/images/play_btn.png), and find the user that you want to assign the client credentials flow.
        
        For Enterprise Edition orgs, we recommend that you select an execution user who has the API Only User permission.
    4. Save your changes.

To disable the client credentials flow on a connected app, deselect **Enable Client Credentials Flow**. Deselecting this setting prevents the client app from getting new access tokens, but it doesn’t revoke existing ones. To revoke access tokens, see [Manage Current OAuth Connected App Sessions](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_current_sessions.htm&type=5&language=en_US).