---
schema_version: "1"
id: 5898b69a9a6f55f19e94dfcd470aed387c97ef6148c7676dca1a5ff0b8763392
title: Manage External Client App OAuth Credentials with AWS Secrets Manager
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/eca_manage_credentials_with_aws_secrets_manager.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.eca_manage_credentials_with_aws_secrets_manager.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: c7593d7edd268b641426072ece01a0136e602e9156009a9dcb90914e23f3b081
description: Maintain credential security as you stage and rotate your client secret with the Amazon Web Services (AWS) Secrets Manager. Using Secrets Manager, the external client app client secret is never exposed. Secrets Manager coordinates the rotation according to the schedule required by your security and compliance mandates.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Manage External Client App OAuth Credentials with AWS Secrets Manager

Maintain credential security as you stage and rotate your client secret with the Amazon Web Services (AWS) Secrets Manager. Using Secrets Manager, the external client app client secret is never exposed. Secrets Manager coordinates the rotation according to the schedule required by your security and compliance mandates.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Lightning Experience.</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Professional</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong> Editions</td></tr></tbody></table>

The AWS Secrets Manager requires details about the external client app and the OAuth credentials. Use the Salesforce org URL and the first two steps in the [Stage, Rotate, and Delete OAuth Credentials](https://help.salesforce.com/s/articleView?id=xcloud.eca_stage_oauth_credentials.htm&release=264.0.0&type=5 "Use the OAuth Staged Credentials Connect REST API endpoint to manage the OAuth key and secret for a local external client app. The API can be used to stage, view, rotate, or delete OAuth credentials.") process to get the external client app ID (identifier) and the consumer ID (`consumer_id`). After you have these values, follow the steps documented by AWS to set up the Secret Manager.

To access Amazon Web Services documentation, go to [https://docs.aws.amazon.com](https://docs.aws.amazon.com). For information about managed external secrets, see the AWS Secrets Manager User Guide. ([Go to Topic](https://docs.aws.amazon.com/secretsmanager/latest/userguide/managed-external-secrets.html))