---
schema_version: "1"
id: 52b21b975bc0e1c8fad635960c555d67827510642d888b475d9d1fd35df8b20b
title: Create or Edit a JWT External Credential
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/nc_create_edit_jwt_ext_cred.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.nc_create_edit_jwt_ext_cred.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 3dd96f865864e7f9cb275429b8e48825808b0d2a1a626ce9aeb4b1b68784ecdf
description: To manage your authentication into the external system with a JSON Web Token (JWT), create an external credential that uses the JWT authentication protocol. The JWT authentication protocol supports server-to-server integration.
products:
  - Security
release: "264"
---
# Create or Edit a JWT External Credential

To manage your authentication into the external system with a JSON Web Token (JWT), create an external credential that uses the JWT authentication protocol. The JWT authentication protocol supports server-to-server integration.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: all editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
          <colgroup>
            <col style="width:50%">
            <col style="width:50%">
          </colgroup>
          <thead class="slds-text-title_caps ">
            <tr class="">
              <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d29938e45">User Permissions
                Needed</th>
            </tr>
          </thead>
          <tbody>
            <tr class="">
              <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d29938e45 ">To view external credentials:</td>

              <td class="slds-cell-wrap" style="vertical-align:top;" headers="d29938e45 ">View Setup and Configuration</td>

            </tr>
            <tr class="">
              <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d29938e45 ">To create, edit, or delete external credentials:</td>

              <td class="slds-cell-wrap" style="vertical-align:top;" headers="d29938e45 ">Manage Named Credentials or Customize Applications</td>

            </tr>
          </tbody>
        </table>

1. From [Setup](https://help.salesforce.com/s/articleView?id=xcloud.basics_nav_setup.htm&type=5&language=en_US), use the Quick Find box to find and select **Named Credentials**.
2. Click **External Credentials**.
3. To create a new external credential, click **New**. To edit an existing external credential, click its link in the list of external credentials and then click **Edit**.
4. Complete the fields.
    
    <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
              <colgroup>
                <col style="width:25%">
                <col style="width:75%">
              </colgroup>
              <thead class="slds-text-title_caps ">
                <tr class="">
                  <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d29938e108">Field</th>
                  <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d29938e110">Description</th>
                </tr>
              </thead>
              <tbody>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d29938e108 "><strong class="uicontrol">Label</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d29938e110 ">A user-friendly name for the external credential that’s shown in the Salesforce user
                    interface, such as in list views.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d29938e108 "><strong class="uicontrol">Name</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d29938e110 ">
                    <p>A unique identifier that’s used to refer to this external credential from callout
                      definitions and through the API.</p>
                    <p style="margin-bottom:0;">The name can contain only underscores and alphanumeric
                      characters. It must be unique, begin with a letter, not include spaces, not end with an
                      underscore, and not contain two consecutive underscores.</p>
                  </td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d29938e108 "><strong class="uicontrol">Authentication Protocol</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d29938e110 ">
                    <p>Select <strong class="uicontrol">JWT</strong>.</p>
                    <p style="margin-bottom:0;">For a complete list of JWT claims, see <a href="https://help.salesforce.com/s/articleView?id=xcloud.nc_jwt_claims.htm&amp;release=264.0.0&amp;type=5" title="If your external credential uses JWT authentication, configure JWT (JSON Web Token) claims.">Set Up JWT Claims for Named
                        Credentials</a>.</p>
                  </td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d29938e108 "><strong class="uicontrol">Issuer (iss)</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d29938e110 ">Specify who issued the JWT, which is a formula. For example, to return the email ID,
                    use the formula <code>{!$User.Email}</code>.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d29938e108 "><strong class="uicontrol">Subject (sub)</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d29938e110 ">Specify the subject of the token (the user), which is a formula.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d29938e108 "><strong class="uicontrol">Audience (aud)</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d29938e110 ">Specify the recipient for whom the token is intended.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d29938e108 "><strong class="uicontrol">JWT Expiration (Seconds)</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d29938e110 ">Specify the time after which the token expires. Expressed as a NumericDate value,
                    representing the number of seconds from 1970-01-01T00:00:00Z UTC until the specified UTC
                    date/time, ignoring leap seconds.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d29938e108 "><strong class="uicontrol">Signing Certificate</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d29938e110 ">Specify the certificate that’s used to verify the JWT’s authenticity to external
                    systems.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d29938e108 "><strong class="uicontrol">Signing Algorithm</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d29938e110 ">Specify the algorithm used to sign the token. Valid values are
                    <strong class="uicontrol">RS256</strong> (default) and <strong class="uicontrol">RS512</strong>.
                  </td>
                </tr>
              </tbody>
            </table>
5. Save the external credential.

## Create Principals for JWT

After you create an external credential that uses JWT authentication, create principals for it. To grant access, you map the principals to permission sets or profiles. A user making a callout must have permission to the principal.

1. On the Named Credentials page, click **External Credential**.
2. Select the external credential that you created.
3. Scroll to Principals.
4. To create a principal for the external credential, click **New** or select **Edit** from the Actions menu of an existing principal.
    
    When editing an existing principal, not all the fields listed here are modifiable.
5. Enter the information for the principal.
    
    <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
                <colgroup>
                  <col style="width:25%">
                  <col style="width:75%">
                </colgroup>
                <thead class="slds-text-title_caps ">
                  <tr class="">
                    <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d29938e245">Field</th>
                    <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d29938e247">Description</th>
                  </tr>
                </thead>
                <tbody>
                  <tr class="">
                    <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d29938e245 "><strong class="uicontrol">Parameter Name</strong></td>
                    <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d29938e247 ">Enter a name for the principal, such as <kbd>Admin</kbd> or
                      <kbd>Marketing Group</kbd>.
                    </td>
                  </tr>
                  <tr class="">
                    <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d29938e245 "><strong class="uicontrol">Sequence Number</strong></td>
                    <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d29938e247 ">Assign a sequence number. A sequence number specifies the order of principals to
                      apply when a user participates in more than one principal. For example, a user could be
                      part of multiple permission sets that are applicable for a credential provider. Priority
                      is from lower to higher numbers.</td>
                  </tr>
                  <tr class="">
                    <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d29938e245 "><strong class="uicontrol">Identity Type</strong></td>
                    <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d29938e247 ">
                      <p>Choose either <strong class="uicontrol">Named Principal</strong> or <strong class="uicontrol">Per User
                          Principal</strong>. </p>
                      <p style="margin-bottom:0;">You can set up each external credential to use an org-wide
                        named principal or per-user authentication. A named principal applies the same credential
                        or authentication configuration for the entire org, while per-user authentication
                        provides access control at the individual user level.</p>
                    </td>
                  </tr>
                </tbody>
              </table>
6. Save the principal.
    
    You can’t modify the Principal Name and Identity Type of an existing principal. To change these parameters, delete the principal and recreate it.

Now that you created the external credential and its principal, it’s time to create the connected name credential. See [Create or Edit a Named Credential](https://help.salesforce.com/s/articleView?id=xcloud.nc_create_edit_named_credential.htm&release=264.0.0&type=5 "Configure a named credential to specify the URL of a callout endpoint. To specify the required authentication parameters for the callout, connect the named credential to an external credential."). For an overview of all of the steps required to configure a named credential, see [Create Named Credentials and External Credentials](https://help.salesforce.com/s/articleView?id=xcloud.nc_named_creds_and_ext_creds.htm&release=264.0.0&type=5 "To simplify the setup of authenticated callouts, create an external credential to specify an authentication protocol and then specify a named credential as the callout endpoint. Add custom headers to cover more use cases and security requirements. Use a permission set or profile to grant access so that users can make authenticated callouts. You can create and configure named credentials programmatically or through the Salesforce UI.").

#### See Also

- [Named Credentials](https://help.salesforce.com/s/articleView?id=xcloud.named_credentials_about.htm&release=264.0.0&type=5 "Intended to secure and simplify authenticated API callouts to external systems, a named credential specifies the URL of a callout endpoint and its required authentication parameters in one definition. To streamline your Apex code and simplify the setup of authenticated callouts, specify a named credential as the callout endpoint.")