---
schema_version: "1"
id: 8b64378b16581f966328cf76297158ccdd85a998f93d8e3699525e6481ca65f2
title: Configure an External Client App to Issue JWT-Based Access Tokens
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/jwt_eca_configuration.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.jwt_eca_configuration.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: ce98b1030c3bd866096f3c9adebab02205bd4c17484facb491a5500347b2b679
description: Enable JWT-based access tokens for an existing external client app that you either created as a developer or installed from a managed package as an admin. Use the External Client Apps Manager in Setup. Or configure your external client app via Metadata API.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Configure an External Client App to Issue JWT-Based Access Tokens

Enable JWT-based access tokens for an existing external client app that you either created as a developer or installed from a managed package as an admin. Use the External Client Apps Manager in Setup. Or configure your external client app via Metadata API.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Group</strong>, <strong>Essentials</strong>, <strong>Professional</strong>, <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong> Editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
          <colgroup>
            <col style="width:50%">
            <col style="width:50%">
          </colgroup>
          <thead class="slds-text-title_caps ">
            <tr class="">
              <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d32089e82">User Permissions
                Needed</th>
            </tr>
          </thead>
          <tbody>
            <tr class="">
              <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d32089e82 ">To configure both settings and policies as an external client app
                developer:</td>

              <td class="slds-cell-wrap" style="vertical-align:top;" headers="d32089e82 ">Create, edit, and delete External Client Apps</td>

            </tr>
            <tr class="">
              <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d32089e82 ">To manage external client app policies as an external client app admin:</td>

              <td class="slds-cell-wrap" style="vertical-align:top;" headers="d32089e82 ">View all External Client Apps, view their settings, and edit their
                policies</td>

            </tr>
          </tbody>
        </table>

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)

Note Connected apps creation is restricted as of Spring ‘26. You can continue to use existing connected apps during and after Spring ‘26. However, we recommend using [external client apps](https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps.htm&language=en_US) instead. If you must continue creating connected apps, contact Salesforce Support.

See [New connected apps can no longer be created in Spring ‘26](https://help.salesforce.com/s/articleView?id=005228017&type=1&language=en_US) for more details.

If you use a JWT-based access token for session authentication, you can’t use `$Api.Session_ID` or `GETSESSIONID()` to return the user’s session ID.

- **[Use the External Client App Manager](https://help.salesforce.com/s/articleView?id=xcloud.jwt_eca_configuration.htm&release=264.0.0&type=5)**  
    In the External Client App Manager in Setup, enable an app to issue JWT-based access tokens instead of opaque access tokens.
- **[Use Metadata API](https://help.salesforce.com/s/articleView?id=xcloud.jwt_eca_configuration.htm&release=264.0.0&type=5)**  
    Use Metadata API to enable an external client app to issue JWT-based access tokens.

## Use the External Client App Manager

In the External Client App Manager in Setup, enable an app to issue JWT-based access tokens instead of opaque access tokens.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)

Note Connected apps creation is restricted as of Spring ‘26. You can continue to use existing connected apps during and after Spring ‘26. However, we recommend using [external client apps](https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps.htm&language=en_US) instead. If you must continue creating connected apps, contact Salesforce Support.

See [New connected apps can no longer be created in Spring ‘26](https://help.salesforce.com/s/articleView?id=005228017&type=1&language=en_US) for more details.

The external client app must be OAuth-enabled.

1. If you’re a developer, enable JWT-based access tokens in the external client app settings. If you’re a subscriber admin, your developer enables this setting for you, so you can skip this step.
    
    1. From Setup, in the Quick Find box, enter External Client Apps, and then select **External Client App Manager**. Next to your app, click ![Dropdown arrow](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/identity/images/connectedappdropdown.png) and select **Edit Settings**.
    2. In OAuth Settings, in the Security section, select **Issue JSON Web Token (JWT)-based access tokens for named users**.
    3. Save the change.
    
    The app now issues JWT-based access tokens instead of opaque access tokens. For installed apps, when you enable this setting, you expose a policy to set the token timeout.
2. In the external client app policies, set the token timeout for named users. If you're a subscriber admin, you control this value for installed apps.
    
    1. From Setup, in the Quick Find box, enter External Client Apps, and then select **External Client App Manager**. Or, if you're already on the Settings tab, click **Policies**.
    2. If you're in the External Client App Manager, next to your app, click ![Dropdown arrow](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/identity/images/connectedappdropdown.png) and select **Edit Policies**. If you're already on the Policies page for the app, click **Edit Policies**.
    3. In the App Authorization section, under Named User JWT-Based Access Token Settings, select an option for the token timeout. This value defines the amount of time before a user's session expires. The timeout for a JWT-based access token is fixed and doesn’t change based on when the token was last active.
    
    - Use the user's default session timeout—With this option, Salesforce uses the timeout defined in the [user's profile session settings](https://help.salesforce.com/s/articleView?id=platform.users_profiles_session.htm&language=en_US) in the Session Times Out After field. If there's no profile session timeout for the user, Salesforce uses the value from the Timeout Value field from your [org session settings](https://help.salesforce.com/s/articleView?id=xcloud.admin_sessions.htm&language=en_US). If both are defined, Salesforce defaults to the profile session timeout.
    - Set app-specific token timeout—With this option, select a timeout value that applies only to this app.
3. If you use the app for the headless guest user flow, set a token timeout value for guest users. If you use the app only for named user flows, skip this step.
    
    1. In the external client app policies page, find OAuth Flows and External Client App Enhancements.
    2. For Guest User JWT-Based Access Token Timeout, select an option for the token timeout.
    
    - Use the Experience Cloud guest user timeout—With this option, Salesforce uses the timeout defined in the [guest user's profile session settings](https://help.salesforce.com/s/articleView?id=platform.rss_config_guest_user_profile.htm&language=en_US) in the Session Times Out After field. If there's no profile session timeout for the user, Salesforce uses the value from the Timeout Value field from your [org session settings](https://help.salesforce.com/s/articleView?id=xcloud.admin_sessions.htm&language=en_US). If both are defined, Salesforce defaults to the profile session timeout.
    - Set app-specific token timeout—With this option, select a timeout value that applies only to this app.
4. Save your changes.
    
    Now, when your app successfully completes an OAuth flow, it issues JWT-based access tokens with the token timeout values that you configured.

## Use Metadata API

Use Metadata API to enable an external client app to issue JWT-based access tokens.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)

Note Connected apps creation is restricted as of Spring ‘26. You can continue to use existing connected apps during and after Spring ‘26. However, we recommend using [external client apps](https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps.htm&language=en_US) instead. If you must continue creating connected apps, contact Salesforce Support.

See [New connected apps can no longer be created in Spring ‘26](https://help.salesforce.com/s/articleView?id=005228017&type=1&language=en_US) for more details.

To use JWT-based access tokens, the OAuth plugin must be enabled for your external client app. For more information, see these resources.

- [Create a Local External Client App](https://help.salesforce.com/s/articleView?id=xcloud.meta_create_a_local_external_client_app.htm&language=en_US)
- [OAuth Plugin Enablement](https://help.salesforce.com/s/articleView?id=xcloud.meta_enable_oauth_plugin.htm&language=en_US)
- [Configure Packageable External Client Apps](https://help.salesforce.com/s/articleView?id=xcloud.meta_configure_packageable_external_client_apps.htm&language=en_US)

1. (Developers only) Edit the JWT-based access tokens in the external client app’s [global OAuth settings file](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_extlclntappglobaloauthsettings.htm).
    
    See [Configure the External Client App Global OAuth Settings](https://help.salesforce.com/s/articleView?id=xcloud.meta_configure_external_client_app_global_oauth_settings.htm&language=en_US).
    
    1. Set the isNamedUserJwtEnabled field to `true`.
    2. Deploy your changes.
2. (Developers and subscribers) Set the token timeout value for named users in the [configurable OAuth policies](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_extlclntappoauthconfigurablepolicies.htm). This value defines the amount of time before the user's session expires. The timeout for a JWT-based access token is fixed and doesn’t change based on when the token was last active. There are two ways to configure the token timeout.
    
    <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
                <colgroup>
                  <col style="width:50%">
                  <col style="width:50%">
                </colgroup>
                <thead class="slds-text-title_caps ">
                  <tr class="">
                    <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d32089e464">Named User token Timeout Option</th>
                    <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d32089e467">Configuration</th>
                  </tr>
                </thead>
                <tbody>
                  <tr class="">
                    <td data-label="Named User token Timeout Option" class="slds-cell-wrap" style="vertical-align:top;" headers="d32089e464 ">Use the user's default session timeout. With this option, Salesforce uses
                      the timeout defined in the <a href="https://help.salesforce.com/s/articleView?id=platform.users_profiles_session.htm&amp;language=en_US" target="_blank">user's profile session settings</a> in the
                      Session Times Out After field. If there's no profile session timeout for the
                      user, Salesforce uses the value from the Timeout Value field from your <a href="https://help.salesforce.com/s/articleView?id=xcloud.admin_sessions.htm&amp;language=en_US" target="_blank">org session settings</a>. If both are
                      defined, Salesforce defaults to the profile session timeout.</td>

                    <td data-label="Configuration" class="slds-cell-wrap" style="vertical-align:top;" headers="d32089e467 ">Set the <samp class="parmname">namedUserJwtSessionTimeoutType</samp> field to
                      <code>UserSession</code>.
                    </td>

                  </tr>
                  <tr class="">
                    <td data-label="Named User token Timeout Option" class="slds-cell-wrap" style="vertical-align:top;" headers="d32089e464 ">Set a timeout value that applies only to this app.</td>

                    <td data-label="Configuration" class="slds-cell-wrap" style="vertical-align:top;" headers="d32089e467 ">
                      <ul>
                        <li>Set the <samp class="parmname">namedUserJwtSessionTimeoutType</samp> field to
                          <code>Custom</code>.
                        </li>

                        <li>For the <samp class="parmname">namedUserJwtTimeout</samp> field, set a timeout
                          value in minutes. For a list of valid values, see <a href="https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_extlclntappoauthconfigurablepolicies.htm" target="_blank">ExtlClntAppOauthConfigurablePolicies</a>
                          in the <cite>Metadata API Developer Guide.</cite></li>

                      </ul>
                    </td>

                  </tr>
                </tbody>
              </table>
3. If you use the app for the headless guest user flow, set a token timeout value for guest users. If you use the app only for named user flows, skip this step.
    
    <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
                <colgroup>
                  <col style="width:50%">
                  <col style="width:50%">
                </colgroup>
                <thead class="slds-text-title_caps ">
                  <tr class="">
                    <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d32089e554">Guest User token Timeout Option</th>
                    <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d32089e557">Configuration</th>
                  </tr>
                </thead>
                <tbody>
                  <tr class="">
                    <td data-label="Guest User token Timeout Option" class="slds-cell-wrap" style="vertical-align:top;" headers="d32089e554 ">Use the Experience Cloud guest user timeout—With this option, Salesforce
                      uses the timeout defined in the <a href="https://help.salesforce.com/s/articleView?id=platform.rss_config_guest_user_profile.htm&amp;language=en_US" target="_blank">guest user's profile session settings</a> in
                      the Session Times Out After field. If there's no profile session timeout for the
                      user, Salesforce uses the value from the Timeout Value field from your <a href="https://help.salesforce.com/s/articleView?id=xcloud.admin_sessions.htm&amp;language=en_US" target="_blank">org session settings</a>. If both are
                      defined, Salesforce defaults to the profile session timeout.</td>

                    <td data-label="Configuration" class="slds-cell-wrap" style="vertical-align:top;" headers="d32089e557 ">Set the <samp class="parmname">guestJwtSessionTimeoutType</samp> field to
                      <code>UserSession</code>.
                    </td>

                  </tr>
                  <tr class="">
                    <td data-label="Guest User token Timeout Option" class="slds-cell-wrap" style="vertical-align:top;" headers="d32089e554 ">Set a timeout value that applies only to this app.</td>

                    <td data-label="Configuration" class="slds-cell-wrap" style="vertical-align:top;" headers="d32089e557 ">
                      <ul>
                        <li>Set the <samp class="parmname">guestJwtSessionTimeoutType</samp> field to
                          <code>Custom</code>.
                        </li>

                        <li>For the <samp class="parmname">guestJwtTimeout</samp> field, set a timeout value in
                          minutes. For a list of valid values, see <a href="https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_extlclntappoauthconfigurablepolicies.htm" target="_blank">ExtlClntAppOauthConfigurablePolicies</a>
                          in the <cite>Metadata API Developer Guide.</cite></li>

                      </ul>
                    </td>

                  </tr>
                </tbody>
              </table>
4. Deploy your changes.