---
schema_version: "1"
id: 7da329b496583445ac010dbd27ad49247d4716121e41280e4411aacc814a9c1e
title: Configure OAuth 2.0 JWT Bearer Flow for External Client Apps
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/meta_configure_oauth_jwt_flow_external_client_apps.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.meta_configure_oauth_jwt_flow_external_client_apps.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 6c601680bd9cb0684fb89bb8fa6b698b38a8e3a9e68b13f4dfeb6f1993c78f44
description: External client apps can support OAuth 2.0 JSON Web Token (JWT) bearer flows using the certificate field in the global OAuth settings file. A JWT flow authorizes servers to access data without interactively logging in each time the servers exchange information.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Configure OAuth 2.0 JWT Bearer Flow for External Client Apps

External client apps can support OAuth 2.0 JSON Web Token (JWT) bearer flows using the certificate field in the global OAuth settings file. A JWT flow authorizes servers to access data without interactively logging in each time the servers exchange information.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d65264e27">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d65264e27 ">To view all external client apps, view their settings, and edit their OAuth policies
              file</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d65264e27 ">View all External Client Apps, view their settings, and edit their policies</td>
          </tr>
        </tbody>
      </table>

To configure a JWT bearer flow, you must first deploy an external client app on your Salesforce org. [Deploy an External Client App That References the Source Org’s Global OAuth Settings File](https://help.salesforce.com/s/articleView?id=xcloud.deploy_external_client_app_that_references_the_source_org.htm&release=264.0.0&type=5 "Deploy an external client app on a new org, and have it reference the source org’s credentials. To configure this relationship, edit the OAuth link in the OAuth settings file and remove the reference to the global OAuth settings file in the package.xml manifest file of the new org."), or [Deploy an External Client App with a New Global OAuth Settings File](https://help.salesforce.com/s/articleView?id=xcloud.deploy_external_client_app_with_global_settings_file.htm&release=264.0.0&type=5 "Deploy the source org’s metadata on an org with its own OAuth consumer. To configure the app, remove the OAuth link in the OAuth settings file and add a reference to the global OAuth settings file in the package.xml manifest file on the new org.").

1. Create an X.509 certificate by following the steps in [OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_jwt_flow.htm&release=264.0.0&type=5 "Sometimes you want to authorize servers to access data without interactively logging in each time the servers exchange information. For these cases, you can use the OAuth 2.0 JSON Web Token (JWT) bearer flow. This flow uses a certificate to sign the JWT request and doesn’t require explicit user interaction. However, this flow does require prior approval of the client app.").
2. Open the extlClntAppGlobalOauthSettings file.
3. If the certificate field doesn’t exist, add it and enter the X.509 certificate as the value for the certificate field.
4. Save the extlClntAppGlobalOauthSets file.
5. Create a JWT following the steps in the [OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_jwt_flow.htm&release=264.0.0&type=5 "Sometimes you want to authorize servers to access data without interactively logging in each time the servers exchange information. For these cases, you can use the OAuth 2.0 JSON Web Token (JWT) bearer flow. This flow uses a certificate to sign the JWT request and doesn’t require explicit user interaction. However, this flow does require prior approval of the client app.").
6. Use this cURL command to request the token for deploying your external client app.
    
    ```
    curl -X POST <org URL>/services/oauth2/token -d 'grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion=<JWT>' | json_pp
    ```
    
    This returns a bearer token you can use to authorize in other flows.