---
schema_version: "1"
id: 91bc6dd527b79132b9d7175789bd002c54c2570e1a816ea3625b65724958d4c6
title: Set Up OAuth Flows
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/external_client_apps_oauth_flow_config.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps_oauth_flow_config.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: ab8a892cff4b8b2cea31411c426c0692d0a2b760912e9279c3bb11b337382d30
description: External Client Apps support several OAuth flows. These flows allow the third-party application to access protected resources on Salesforce.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Set Up OAuth Flows

External Client Apps support several OAuth flows. These flows allow the third-party application to access protected resources on Salesforce.

Determine which flow to enable and set the basic OAuth flow configurations. For detailed descriptions of OAuth flows, see [OAuth Authorization Flows](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_flows.htm&release=264.0.0&type=5 "OAuth authorization flows grant a client application restricted access to protected resources on a resource server. Each OAuth flow offers a different process for approving access to a client app, but in general the flows consist of three main steps. To initiate an authorization flow, a client app requests access to a protected resource. In response, an authorizing server grants access tokens to the client app. A resource server then validates these access tokens and approves access to the protected resource.").

- **[Configure a Client Credentials Flow](https://help.salesforce.com/s/articleView?id=xcloud.configure_client_credentials_flow_for_external_client_apps.htm&release=264.0.0&type=5)**  
    To share information between two applications without any input from a user, use the OAuth 2.0 client credentials flow. In this flow, the client app exchanges its client credentials that are defined in the external client app for an access token. For this flow, you must specify an integration user to run the integration.
- **[Configure a Code and Credentials Flow](https://help.salesforce.com/s/articleView?id=xcloud.configure_oauth_code_credentials_flow_external_client_apps.htm&release=264.0.0&type=5)**  
    The Code and Credentials Flow is the foundation of headless login, registration, passwordless login, and guest user identity. Before setting up these features, enable the Code and Credentials Flow at an org-wide level and configure these required settings and access policies for your external client app.
- **[Configure a Device Flow](https://help.salesforce.com/s/articleView?id=xcloud.configure_device_flow_external_client_apps.htm&release=264.0.0&type=5)**  
    To integrate apps that run on devices with limited input or display capabilities, such as smart TVs, appliances, and other internet of things (IoT) devices, configure the Global OAuth Settings to include a device code, and enable the OAuth 2.0 device flow. Command-line apps can use this flow as well. Users can connect these apps to Salesforce by accessing a browser on a device with more advanced input capabilities, such as a desktop or mobile device.
- **[Configure a JWT Bearer Flow](https://help.salesforce.com/s/articleView?id=xcloud.configure_oauth_jwt_flow_external_client_apps.htm&release=264.0.0&type=5)**  
    External client apps can support OAuth 2.0 JSON Web Token (JWT) bearer flows using the certificate field in the global OAuth settings file. A JWT flow authorizes servers to access data without interactively logging in each time the servers exchange information.
- **[Configure a Web Server Flow](https://help.salesforce.com/s/articleView?id=xcloud.configure_web_server_flow_for_external_client_apps.htm&release=264.0.0&type=5)**  
    To integrate an external web app with the Salesforce API, configure an external client app to use the OAuth 2.0 web server flow, which implements the OAuth 2.0 authorization code grant type.