---
schema_version: "1"
id: ba9bf18152a8686a1024adf99c456d28eb0111242b25e08ae61c511146d8216b
title: Configure Custom Scopes for External Client Apps
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/custom_scopes_for_external_client_apps.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.custom_scopes_for_external_client_apps.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 58988a60f4120589b27733573326b79ad118946f5e405383d3ac4174a27cc550
description: Personalize your external client apps by using OAuth custom scopes. Like with connected apps, OAuth custom scopes define the permissions of an external client app to access protected resources hosted by an external entity. External client apps support packaging these custom scopes for distribution.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Configure Custom Scopes for External Client Apps

Personalize your external client apps by using OAuth custom scopes. Like with connected apps, OAuth custom scopes define the permissions of an external client app to access protected resources hosted by an external entity. External client apps support packaging these custom scopes for distribution.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Professional</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong> Editions</td></tr></tbody></table>

OAuth custom scopes for external client apps work the same as [OAuth custom scopes for connected apps](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_customscopes.htm&release=264.0.0&type=5 "An external client app can use the OAuth authorization protocol to access protected resources. As part of the protocol, OAuth default scopes fine-tune the app’s permissions to access protected resources in Salesforce. However, these default scopes are insufficient when an external entity hosts the protected resource. In this scenario, Salesforce plays the role of OAuth authentication and authorization provider, but it has little knowledge about the resource it’s protecting. To define an external client app’s permissions to access protected resources hosted by an external entity, create an OAuth custom scope. The custom scope tells the external entity which information the external client app is authorized to access."). To use a custom scope, you must first create the scope and then assign it to the external client app.

Custom scopes can be set in the Policies, Settings, and Package Defaults tabs for external client apps. Developers can set custom scopes for local external client apps and define default values for apps for packaging. Admins can add, edit, or remove custom scopes from their external client apps.

## Custom Scopes and 2GP Managed Packaging

Because custom scopes are created independently from external client apps, they must be packaged separately as well. To package an external client app with custom scopes, package the custom scopes by using second-generation (2GP) managed packaging, and then package the external client app as a 2GP managed package. To install an external client app that includes custom scopes, you must install the custom scope package before you install the external client app package.

If your custom scopes use custom labels as descriptions, package these labels separately as well. In this case you must package the custom labels by using 2GP managed packaging, then package the custom scopes by using 2GP managed packaging, and then package the external client app as a 2GP managed package. The installation process must follow this order as well. To install an external client app that includes custom scopes with custom labels, first install the custom label package, then the custom scope package, and then install the external client app package.