---
schema_version: "1"
id: fee533d7773ebf3d4653fd6c7cf71c6fad82ce7162f5c92d54754681d7a26092
title: Configure OAuth Policies
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/external_client_app_oauth_policies_configuration.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.external_client_app_oauth_policies_configuration.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 39012eb8f5b168251becc3fe8dc99307c75d27fed510f5572cfb65678f5bb24d
description: OAuth policies are an important part of the external client app OAuth plugin that are generated with default values when an external client app is saved or during deployment to a subscriber org. Admins configure the OAuth policies file for their specific use case.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Configure OAuth Policies

OAuth policies are an important part of the external client app OAuth plugin that are generated with default values when an external client app is saved or during deployment to a subscriber org. Admins configure the OAuth policies file for their specific use case.

Policies only apply to the org where they are configured, whether that is the same org where the external client app was created or the external client app was installed. After an admin updates policies, the values persist even if the developer updates the app Settings.

- **[Configure a Custom Attribute for External Client Apps](https://help.salesforce.com/s/articleView?id=xcloud.configure_custom_attributes_for_external_client_apps.htm&release=264.0.0&type=5)**  
    Create custom attributes to capture useful and unique information. With custom attributes, you can get more information about a user’s identity such as an address or job title. Configure custom attributes for your external client app in the Policies tab.
- **[Configure Client Credential Flow Policies for External Client Apps](https://help.salesforce.com/s/articleView?id=xcloud.policies_configure_client_credentials_flow_for_external_client_apps.htm&release=264.0.0&type=5)**  
    After Client Credentials Flows setting is enabled, configure the flow’s policies.
- **[Configure OAuth 2.0 Code and Credential Flow Policies for External Client Apps](https://help.salesforce.com/s/articleView?id=xcloud.policies_configure_authorization_code_credentials_flow_for_external_client_apps.htm&release=264.0.0&type=5)**  
    After Client Credentials Flows setting is enabled, configure the flow’s policies.
- **[Stage, Rotate, and Delete OAuth Credentials for a Local External Client App](https://help.salesforce.com/s/articleView?id=xcloud.eca_stage_oauth_credentials.htm&release=264.0.0&type=5)**  
    Use the OAuth Staged Credentials Connect REST API endpoint to manage the OAuth key and secret for a local external client app. The API can be used to stage, view, rotate, or delete OAuth credentials.
- **[Manage External Client App OAuth Credentials with AWS Secrets Manager](https://help.salesforce.com/s/articleView?id=xcloud.eca_manage_credentials_with_aws_secrets_manager.htm&release=264.0.0&type=5)**  
    Maintain credential security as you stage and rotate your client secret with the Amazon Web Services (AWS) Secrets Manager. Using Secrets Manager, the external client app client secret is never exposed. Secrets Manager coordinates the rotation according to the schedule required by your security and compliance mandates.