---
schema_version: "1"
id: 6d6697af92a39d766bc71804849d7176d0394de2c4acacd1b30a49e8962a9b88
title: "Headless Identity APIs: Configure an External Client App for the Authorization Code and Credentials Flow"
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/eca_authorization_code_credentials.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.eca_authorization_code_credentials.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 4fea0b0ca283c6745c7eb391697f2394ff7777adf1812acd7cc95f96d47d02a3
description: To integrate with Salesforce Headless Identity APIs, configure an external client app for the Authorization Code and Credentials Flow. Use the External Client App Manager in Setup. Or configure your external client app via Metadata API. External client apps support all variations of the Authorization Code and Credentials Flow, including headless login, passwordless login, registration, and guest user variations.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Headless Identity APIs: Configure an External Client App for the Authorization Code and Credentials Flow

To integrate with Salesforce Headless Identity APIs, configure an external client app for the Authorization Code and Credentials Flow. Use the External Client App Manager in Setup. Or configure your external client app via Metadata API. External client apps support all variations of the Authorization Code and Credentials Flow, including headless login, passwordless login, registration, and guest user variations.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Enterprise</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong> Editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
          <colgroup>
            <col style="width:50%">
            <col style="width:50%">
          </colgroup>
          <thead class="slds-text-title_caps ">
            <tr class="">
              <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d13301e50">User Permissions Needed</th>
            </tr>
          </thead>
          <tbody>
            <tr class="">
              <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d13301e50 ">To configure both settings and policies as an external client app developer:</td>
              <td class="slds-cell-wrap" style="vertical-align:top;" headers="d13301e50 ">Create, edit, and delete External Client Apps</td>
            </tr>
            <tr class="">
              <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d13301e50 ">To manage external client app policies as an external client app admin:</td>
              <td class="slds-cell-wrap" style="vertical-align:top;" headers="d13301e50 ">View all External Client Apps, view their settings, and edit their policies</td>
            </tr>
          </tbody>
        </table>

For the Authorization Code and Credentials Flow, an external client app must have several settings and policies enabled. Your access to settings and policies depends on your role, as defined by your user permissions. Developers configure both settings and policies. They can use settings to control what policies admins can access. Admins configure only policies. If you’re an admin and you can’t find a certain policy, contact the app developer.

- **[Use the External Client App Manager](https://help.salesforce.com/s/articleView?id=xcloud.eca_authorization_code_credentials.htm&release=264.0.0&type=5)**  
    Use the External Client App Manager in Setup to configure an external client app for the Authorization Code and Credentials Flow.
- **[Use Metadata API](https://help.salesforce.com/s/articleView?id=xcloud.eca_authorization_code_credentials.htm&release=264.0.0&type=5)**  
    Use Metadata API to configure an external client app for the Authorization Code and Credentials Flow.

## Use the External Client App Manager

Use the External Client App Manager in Setup to configure an external client app for the Authorization Code and Credentials Flow.

To use the Authorization Code and Credentials Flow, it must be enabled for your org on the OAuth and OpenID Connect Settings page in Setup. Your external client app must be enabled for OAuth. The guest user variation of the Authorization Code and Credentials Flow supports only JSON Web Token (JWT)-based access tokens. To use this flow variation, [enable your external client app to issue JWT-based access tokens](https://help.salesforce.com/s/articleView?id=xcloud.jwt_eca_configuration.htm&type=5&language=en_US).

1. (Developers only) Edit the external client app settings. If you’re an admin, your developer enables these settings for you.
    1. From Setup, in the Quick Find box, enter External Client App, and then select **External Client App Manager**. Next to your app, click ![Dropdown](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/identity/images/connectedappdropdown.png), and then select **Edit Settings**.
    2. In OAuth Settings, in the Flow Enablement section, select **Enable Code and Credential Flow**.
    3. Control whether your app is required to send its consumer secret (`client_secret`) in requests to the token endpoint
        
        If you’re using a client backend to implement this flow for a private client, select **Require user credentials in the POST body for Authorization Code and Credentials Flow**. Ensure that your client backend can keep the consumer secret secure.
        
        If you’re using this flow with a public client, such as a single-page app, deselect **Require user credentials in the POST body for Authorization Code and Credentials Flow** to avoid leaking the consumer secret in the browser.
    4. (Optional) To require the Proof Key for Code Exchange (PKCE) extension for your flow, select **Require Proof Key for Code Exchange (PKCE) extension for Supported Authorization Flows**. We strongly recommend PKCE for public clients because these apps can’t use the consumer secret to protect the code exchange. We also recommend it for private clients, but it’s less critical.
    5. Save your changes.
        
        After you save the changes, Salesforce directs you to the external client app Policies tab.
2. Edit the external client app policies.
    
    1. Go to the app’s Policies tab if you aren’t there already. From Setup, in the Quick Find box, enter External Client Apps, and then select **External Client App Manager**. Next to your app, click ![Dropdown](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/identity/images/connectedappdropdown.png), and then select **Edit Policies**.
    2. In App Policies, for Permitted Users, select **Admin-approved users are pre-authorized**.
    3. To admin-approve users, select permission sets assigned to your app’s users. For more information, see [Permission Sets](https://help.salesforce.com/s/articleView?id=platform.perm_sets_overview.htm&type=5&language=en_US).
    4. Save your changes.
    
    Your app can now use the Authorization Code and Credentials Flow for headless login, passwordless login, and registration.
3. To use your app for the guest user flow variation, configure these additional configurable OAuth policies.
    1. To enable the guest user variation, turn on **Enable Code and Credentials Flow for Guest Users**.
    2. To define how long the guest access token is valid after it’s issued, select an option for the Guest JSON Web Token (JWT) Timeout.
    3. Save your changes.

## Use Metadata API

Use Metadata API to configure an external client app for the Authorization Code and Credentials Flow.

To use the Authorization Code and Credentials Flow, the oAuthCdCrdtFlowEnable field on the OauthOidcSettings metadata type must be `true`.

The OAuth plugin must also be enabled for your external client app. For more information, see these resources.

- [Create a Local External Client App](https://help.salesforce.com/s/articleView?id=xcloud.meta_create_a_local_external_client_app.htm&language=en_US)
- [OAuth Plugin Enablement](https://help.salesforce.com/s/articleView?id=xcloud.meta_enable_oauth_plugin.htm&language=en_US)
- [Configure Packageable External Client Apps](https://help.salesforce.com/s/articleView?id=xcloud.meta_configure_packageable_external_client_apps.htm&language=en_US)

The guest user variation of the Authorization Code and Credentials Flow supports only JSON Web Token (JWT)-based access tokens. To use this flow variation, [enable your external client app to issue JWT-based access tokens](https://help.salesforce.com/s/articleView?id=xcloud.jwt_eca_configuration.htm&language=en_US).

1. (Developers only) Configure these settings in the external client app’s [global OAuth settings file](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_extlclntappglobaloauthsettings.htm).
    
    1. Set the isCodeCredFlowEnabled field to `true`.
    2. (Optional) For security, to require your app to send the user’s credentials in the body of a POST request to the authorization endpoint, set isCodeCredPostOnly to `true`. When set to `false`, you can use either a POST or a GET request, and the user’s credentials can be in the request body or in a Basic authorization header.
    3. To control whether your app is required to send its consumer secret (`client_secret`) in requests to the token endpoint, configure the isConsumerSecretOptional field.
        
        If you’re using a client backend to implement this flow for a private client, set this field to `true`. Ensure that your client backend can keep the consumer secret secure.
        
        If you’re using this flow with a public client, such as a single-page app, set this field to `false` to avoid leaking the consumer secret in the browser.
    4. (Optional) To require the Proof Key for Code Exchange (PKCE) extension for your flow, set isPkceRequired to `true`. We strongly recommend PKCE for public clients because these apps can’t use the consumer secret to protect the code exchange. We also recommend it for private clients, but it’s less critical.
    5. Deploy the changes.
    
    For more information, see [Configure the External Client App Global OAuth Settings](https://help.salesforce.com/s/articleView?id=xcloud.meta_configure_external_client_app_global_oauth_settings.htm&language=en_US).
2. Modify the app’s [configurable OAuth policies](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_extlclntappoauthconfigurablepolicies.htm).
    
    1. Set the value for permittedUsersPolicyType to `AdminApprovedPreAuthorized`.
        
        ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)
        
        Note Saving this change causes all users currently using the app to lose access.
    2. To define which users are admin-approved, use [permission sets](https://help.salesforce.com/s/articleView?id=platform.perm_sets_overview.htm&language=en_US). Enter a list of permission set IDs for the commaSeparatedPermissionSet field.
    
    Your app can now use the Authorization Code and Credentials Flow for headless login, passwordless login, and registration.
3. To use your app for the guest user flow variation, configure these additional [configurable OAuth policies](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_extlclntappoauthconfigurablepolicies.htm).
    1. To enable the guest user variation, set isGuestCodeCredFlowEnabled to `true`.
    2. To define how long the guest access token is valid after it’s issued, use one of these options.
        
        <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
                    <colgroup>
                      <col style="width:50%">
                      <col style="width:50%">
                    </colgroup>
                    <thead class="slds-text-title_caps ">
                      <tr class="">
                        <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d13301e409">Guest User token Timeout Option</th>
                        <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d13301e412">Configuration</th>
                      </tr>
                    </thead>
                    <tbody>
                      <tr class="">
                        <td data-label="Guest User token Timeout Option" class="slds-cell-wrap" style="vertical-align:top;" headers="d13301e409 ">Use the Experience Cloud guest user timeout—With this option,
                          Salesforce uses the timeout defined in the <a href="https://help.salesforce.com/s/articleView?id=platform.rss_config_guest_user_profile.htm&amp;language=en_US" target="_blank">guest user's profile session
                            settings</a> in the Session Times Out After field. If there's no
                          profile session timeout for the user, Salesforce uses the value from the
                          Timeout Value field from your <a href="https://help.salesforce.com/s/articleView?id=xcloud.admin_sessions.htm&amp;language=en_US" target="_blank">org session settings</a>. If both are
                          defined, Salesforce defaults to the profile session timeout.</td>

                        <td data-label="Configuration" class="slds-cell-wrap" style="vertical-align:top;" headers="d13301e412 ">Set the <samp class="parmname">guestJwtSessionTimeoutType</samp> field to
                          <code>UserSession</code>.
                        </td>

                      </tr>
                      <tr class="">
                        <td data-label="Guest User token Timeout Option" class="slds-cell-wrap" style="vertical-align:top;" headers="d13301e409 ">Set a timeout value that applies only to this app.</td>

                        <td data-label="Configuration" class="slds-cell-wrap" style="vertical-align:top;" headers="d13301e412 ">
                          <ul>
                            <li>Set the <samp class="parmname">guestJwtSessionTimeoutType</samp> field to
                              <code>Custom</code>.
                            </li>

                            <li>For the <samp class="parmname">guestJwtTimeout</samp> field, set a timeout
                              value in minutes. For a list of valid values, see <a href="https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_extlclntappoauthconfigurablepolicies.htm" target="_blank">ExtlClntAppOauthConfigurablePolicies</a> in the <cite>Metadata API
                                Developer Guide.</cite></li>

                          </ul>
                        </td>

                      </tr>
                    </tbody>
                  </table>
    3. Deploy the changes.