---
schema_version: "1"
id: e8f92bb10fa59180a3c9cee0b2758f1e00c72e3f74e8b9f775aab8a5544d16ac
title: Configure the External Client App Global OAuth Settings
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/meta_configure_external_client_app_global_oauth_settings.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.meta_configure_external_client_app_global_oauth_settings.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 16d85f9c3188b0d35604c9e7a677e8d66cd9a358c4e0ec75c115f9a486252b24
description: Configure a global settings file, which affects every instance where the external client app is deployed.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Configure the External Client App Global OAuth Settings

Configure a global settings file, which affects every instance where the external client app is deployed.

1. Create a file called \[ECAPP\_OAUTH\_CONSUMER\].ecaGlblOauth-meta.xml, for example, myecaconsumer.ecaGlblOauth-meta.xml, in a directory called extlClntAppGlobalOauthSets. This file is the global OAuth settings file, which includes sensitive OAuth consumer information.
2. Configure the file with this information.
    
     
    | Field | Description |
    | --- | --- |
    | callbackUrl | This field is optional. Type: String. The endpoint that Salesforce calls back to your external client app during OAuth. It’s the OAuth redirect\_uri. |
    | consumerKey | This field is optional. Type: String. A value used by the consumer for identification to Salesforce. Referred to as client\_id in OAuth 2.0. |
    | consumerSecret | This field is optional. Type: String. A value that is combined with the consumerKey and used by the consumer for identification to Salesforce. Referred to as client\_secret in OAuth 2.0. |
    | externalClientApplication | This field is required. Type: String. Name of the external client application. |
    | idTokenAudience | This field is optional. Type: String. The audiences that this ID token is intended for. |
    | idTokenIncludeStandardClaims | This field is optional. Type: Boolean. Indicates whether standard claims about the authentication event are included in the ID token. |
    | idTokenValidityInMinutes | This field is optional. Type: Integer. The length of time that the ID token is valid for after it’s issued. The value can be 1–720 minutes. |
    | isConsumerSecretOptional | This field is optional. Type: Boolean. If set to false (default), the external app’s client secret is required in exchange for an access token in the OAuth 2.0 web server flow. |
    | isIntrospectAllTokens | This field is optional. Type: Boolean. If set to true, authorizes the external app to introspect all access and refresh all tokens. If set to false (default), the external client app can introspect its own tokens. |
    | isPkceRequired | This field is required. Type: Boolean. If set to true (default) Proof Key for Code for Exchange (PKCE) is required for OAuth integration. |
    | isSecretRequiredForRefreshToken | This field is optional. Type: Boolean. If set to true (default), the app’s client secret is required in the authorization request of a refresh token and hybrid refresh token flow. If set to false and an app sends the client secret in the authorization request, Salesforce still validates it. |
    | label | This field is required. Type: String. External Client Application Global OAuth Settings Name. |
    | shouldRotateConsumerKey | This field is optional. Type: Boolean. If set to `true` then the external client app's OAuth consumer key is replaced with a newly generated key on metadata deploy. Default is `false`. Rotating consumer credentials causes app failure if the external client app is not set up for rotation. To maintain security, you must include the ignore warnings attribute `--ignorewarnings` in the deploy command if this field is set to `true`. |
    | shouldRotateConsumerSecret | This field is optional. Type: Boolean. If set to `true` then the OAuth external client app's consumer secret is replaced with a newly generated secret on metadata deploy. Default is `false`. Rotating consumer credentials causes app failure if the external client app is not set up for rotation. To maintain security, you must include the ignore warnings attribute `--ignorewarnings` in the deploy command if this field is set to `true`. |
    
    The global settings file looks like this example.
    
    ```
    <?xml version="1.0" encoding="UTF-8"?>
    <ExtlClntAppGlobalOauthSettings xmlns="http://soap.sforce.com/2006/04/metadata">
        <callbackUrl>https://www.example.com</callbackUrl>
        <externalClientApplication>myeca</externalClientApplication>
        <idTokenConfig>
            <idTokenAudience>SalesforceAudience</idTokenAudience>
            <idTokenIncludeStandardClaims>true</idTokenIncludeStandardClaims>
            <idTokenValidityInMinutes>0</idTokenValidityInMinutes>
        </idTokenConfig>
        <isConsumerSecretOptional>false</isConsumerSecretOptional>
        <isIntrospectAllTokens>false</isIntrospectAllTokens>
        <isPkceRequired>true</isPkceRequired>
        <isSecretRequiredForRefreshToken>false</isSecretRequiredForRefreshToken>
        <label>myecaglobalset</label>
        <shouldRotateConsumerKey>false</shouldRotateConsumerKey>
        <shouldRotateConsumerSecret>false</shouldRotateConsumerSecret>
    </ExtlClntAppGlobalOauthSettings>
    ```