---
schema_version: "1"
id: 6d3a702eeefbe62850721da0129eb361915fd757a9f53fe80e629c4044ebc80a
title: Integrate Service Providers as Connected Apps with OpenID Connect
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/connected_app_create_openid_connect.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create_openid_connect.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: ad43330aae0f4532ae1a00c8d3f9571b62fec6267b06e567ec71a4b432c5c54c
description: To integrate a service provider with your Salesforce org, you can use a connected app that implements OpenID Connect for user authentication. To use this option, the service provider must accept OpenID Connect tokens. Configure a connected app with the OpenID Connect scope for your service provider. The OpenID Connect scope passes user information in an ID token. Users can then log in to the external app with their Salesforce or Experience Cloud credentials.
release: "264"
---
# Integrate Service Providers as Connected Apps with OpenID Connect

To integrate a service provider with your Salesforce org, you can use a connected app that implements OpenID Connect for user authentication. To use this option, the service provider must accept OpenID Connect tokens. Configure a connected app with the OpenID Connect scope for your service provider. The OpenID Connect scope passes user information in an ID token. Users can then log in to the external app with their Salesforce or Experience Cloud credentials.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
        <colgroup>
          <col>
        </colgroup>
        <tbody>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and
              Lightning Experience</td>
          </tr>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">
              <p>Connected Apps can be created in: <strong>Group</strong>, <strong>Essentials</strong>,
                <strong>Professional</strong>, <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and
                <strong>Developer</strong> Editions
              </p>
              <p style="margin-bottom:0;">Connected Apps can be installed in: All editions</p>
            </td>
          </tr>
        </tbody>
      </table> <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d90423e55">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d90423e55 ">To read, create, update, or delete connected apps:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d90423e55 ">
              <p>Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data OR Manage Connected
                Apps</p>
            </td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d90423e55 ">To update all fields except Profiles, Permission Sets, and Service Provider SAML
              Attributes:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d90423e55 ">
              <p>Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data OR Manage Connected
                Apps</p>
            </td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d90423e55 ">To update Profiles, Permission Sets, and Service Provider SAML Attributes:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d90423e55 ">Customize Application AND Modify All Data AND Manage Profiles and Permission
              Sets</td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d90423e55 ">To rotate the consumer key and consumer secret:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d90423e55 ">Allow consumer key and secret rotation</td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d90423e55 ">To install and uninstall connected apps:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d90423e55 ">
              <p>Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data OR Manage Connected
                Apps</p>
            </td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d90423e55 ">To install and uninstall packaged connected apps:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d90423e55 ">
              <p>Download AppExchange Packages AND Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data
                OR Manage Connected Apps</p>
            </td>
          </tr>
        </tbody>
      </table>

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_note.png)

Note Connected apps creation is restricted as of Spring ‘26. You can continue to use existing connected apps during and after Spring ‘26. However, we recommend using [external client apps](https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps.htm&language=en_US) instead. If you must continue creating connected apps, contact Salesforce Support.

See [New connected apps can no longer be created in Spring ‘26](https://help.salesforce.com/s/articleView?id=005228017&type=1&language=en_US) for more details.

For example, you want your users to sign on directly from your Salesforce org to an external Wellness Tracker app that accepts OpenID Connect. So you create a connected app for the Wellness Tracker app. For the connected app, you enable OAuth settings, select the “Allow access to your unique identifier (openid)” scope, and configure an ID token. This configuration enables the SSO flow for your Wellness Tracker app by integrating the service provider with your Salesforce org.

1. Create your connected app, and complete its [basic information](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create_basics.htm&type=5&language=en_US).
2. Configure the necessary [OAuth settings](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create_api_integration.htm&type=5&language=en_US) for the connected app.
3. Select the **Allow access to your unique identifier (openid)** scope to apply to the connected app.
4. Select **Configure ID token**.
5. With the primary ID token setting enabled, configure the secondary settings that control the ID token contents in both access and refresh token responses. Specify these settings.
    
     
    | Setting | Description |
    | --- | --- |
    | **Token Valid for** | The length of time that the ID token is valid for after it’s issued. The period can be from 1 to 720 minutes. The default is 2 minutes. |
    | **ID Token Audiences** | The intended consumers of the ID token. For example, the target service where you use the ID token, such as https://your\_service.com. |
    | **Include Standard Claims** | Include the standard claims that contain information about the user, such as the user’s name, profile, phone number, and address. The OpenID Connect specifications define a set of standard claims to be returned in the ID token. |
    | **Include Custom Attributes** | If your app has specified custom attributes, include them in the ID token. |
    | **Include Custom Permissions** | If your app has specified custom permissions, include them in the ID token. |
6. To automatically log users out of the service provider when they log out of Salesforce, select **Enable Single Logout**.
7. Enter the single logout endpoint of the service provider. Salesforce sends logout requests to this URL when users log out of Salesforce. The single logout URL must be an absolute URL starting with https://.
8. When you’ve configured all settings for your connected app, click **Save**.