---
schema_version: "1"
id: 056d10052c04d77ea5ec482ab8e2317d32978688ce8e6caaf439916a85a717d0
title: Configure a Connected App to Issue JWT-Based Access Tokens
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/jwt_connectedapp_enable.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.jwt_connectedapp_enable.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 15bbe770e46086981268c48be25a0d4a3d717f9a33f5714c78e58488985ba4a4
description: Enable JWT-based access tokens for an existing connected app that you either created or installed from a managed package.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Configure a Connected App to Issue JWT-Based Access Tokens

Enable JWT-based access tokens for an existing connected app that you either created or installed from a managed package.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>All</strong> Editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d54130e59">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d54130e59 ">To read, create, update, or delete connected apps:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d54130e59 ">
              <p>Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data OR Manage Connected
                Apps</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d54130e59 ">To update all fields except Profiles, Permission Sets, and Service Provider
              SAML Attributes:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d54130e59 ">
              <p>Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data OR Manage Connected
                Apps</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d54130e59 ">To update Profiles, Permission Sets, and Service Provider SAML
              Attributes:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d54130e59 ">Customize Application AND Modify All Data AND Manage Profiles and Permission
              Sets</td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d54130e59 ">To rotate the consumer key and consumer secret:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d54130e59 ">Allow consumer key and secret rotation</td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d54130e59 ">To install and uninstall connected apps:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d54130e59 ">
              <p>Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data OR Manage Connected
                Apps</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d54130e59 ">To install and uninstall packaged connected apps:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d54130e59 ">
              <p>Download AppExchange Packages AND Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All
                Data OR Manage Connected Apps</p>
            </td>

          </tr>
        </tbody>
      </table>

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)

Note Connected apps creation is restricted as of Spring ‘26. You can continue to use existing connected apps during and after Spring ‘26. However, we recommend using [external client apps](https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps.htm&language=en_US) instead. If you must continue creating connected apps, contact Salesforce Support.

See [New connected apps can no longer be created in Spring ‘26](https://help.salesforce.com/s/articleView?id=005228017&type=1&language=en_US) for more details.

If you use a JWT-based access token for session authentication, you can’t use `$Api.Session_ID` or `GETSESSIONID()` to return the user’s session ID.

1. If you’re an app developer, edit the connected app OAuth settings. If you’re a subscriber admin, the app developer completes this step for you.
    
    1. From Setup, in the Quick Find box, enter App, and then select **App Manager**.
    2. Next to your app, click ![Dropdown arrow](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/identity/images/connectedappdropdown.png), and then select **Edit**.
    3. Under API (Enable OAuth Settings), select **Issue JSON Web Token (JWT)-based access tokens for named users**.
    4. Save the change.
    
    The app now issues JWT-based access tokens instead of opaque access tokens. When you enable this setting, you expose a policy to set the token timeout. Subscriber admins can access this policy in installed apps.
2. In the connected app policies, set the token timeout for named users. If you're a subscriber admin, you control this value for installed apps.
    
    1. From Setup, in the Quick Find box, enter App, and then select **App Manager**. Next to your app, click ![Dropdown arrow](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/identity/images/connectedappdropdown.png), and then select **Manage**.
        
        Or, if you’re on the connected app page already, click **Manage**.
    2. Click **Edit Policies**.
    3. Under Session Policies, in the Named User JWT-Based Access Token Timeout section, select an option for the token timeout. This value defines the amount of time before the user's session expires. The timeout for a JWT-based access token is fixed and doesn’t change based on when the token was last active.
    
    - Use the user's default session timeout—With this option, Salesforce uses the timeout defined in the [user's profile session settings](https://help.salesforce.com/s/articleView?id=platform.users_profiles_session.htm&language=en_US) in the Session Times Out After field. If there's no profile session timeout for the user, Salesforce uses the value from the Timeout Value field from your [org session settings](https://help.salesforce.com/s/articleView?id=xcloud.admin_sessions.htm&language=en_US). If both are defined, Salesforce defaults to the profile session timeout.
    - Set app-specific token timeout—With this option, select a timeout value that applies only to this app.
3. If you use the app for the headless guest user flow, set a token timeout value for guest users. If you use the app only for named user flows, skip this step.
    
    1. In the connected app policies page, find Authorization Code and Credentials Flow.
    2. Select an option for the guest user token timeout.
    
    - Use the Experience Cloud guest user timeout—With this option, Salesforce uses the timeout defined in the [guest user's profile session settings](https://help.salesforce.com/s/articleView?id=platform.rss_config_guest_user_profile.htm&language=en_US) in the Session Times Out After field. If there's no profile session timeout for the user, Salesforce uses the value from the Timeout Value field from your [org session settings](https://help.salesforce.com/s/articleView?id=xcloud.admin_sessions.htm&language=en_US). If both are defined, Salesforce defaults to the profile session timeout.
    - Set app-specific token timeout—With this option, select a timeout value that applies only to this app.
4. Save your changes.
    
    Now, when your app successfully completes an OAuth flow, it issues JWT-based access tokens with the token timeout values that you configured.