---
schema_version: "1"
id: 0a0a1d10179a4b8fa2845821a1a58f4f6619e49f7d5b956fc00ce345a23919ff
title: Create or Edit an OAuth External Credential with the Browser Flow
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/nc_create_edit_oath_browser_ext_cred.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.nc_create_edit_oath_browser_ext_cred.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: e4b4a979d518880bffbc13fbd6d91d19ea3c28ce49eb51d7f37e08d0e7e46e7b
description: With an OAuth 2.0 external credential that uses the Browser Flow, one or more users logs into the remote system via a web browser to trigger a callback that includes access tokens. The returned tokens authenticate calls to the endpoint defined in the named credential.
products:
  - Security
release: "264"
---
# Create or Edit an OAuth External Credential with the Browser Flow

With an OAuth 2.0 external credential that uses the Browser Flow, one or more users logs into the remote system via a web browser to trigger a callback that includes access tokens. The returned tokens authenticate calls to the endpoint defined in the named credential.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: all editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
          <colgroup>
            <col style="width:50%">
            <col style="width:50%">
          </colgroup>
          <thead class="slds-text-title_caps ">
            <tr class="">
              <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d76724e45">User Permissions
                Needed</th>
            </tr>
          </thead>
          <tbody>
            <tr class="">
              <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d76724e45 ">To view external credentials:</td>

              <td class="slds-cell-wrap" style="vertical-align:top;" headers="d76724e45 ">View Setup and Configuration</td>

            </tr>
            <tr class="">
              <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d76724e45 ">To create, edit, or delete external credentials:</td>

              <td class="slds-cell-wrap" style="vertical-align:top;" headers="d76724e45 ">Manage Named Credentials or Customize Applications</td>

            </tr>
          </tbody>
        </table>

This help content describes how to set up an OAuth external credential with the Browser Flow. For an end-to-end example implementation, see [Named Credential Example: OAuth 2.0 Browser Flow with a Named Principal](https://help.salesforce.com/s/articleView?id=xcloud.nc_example_oauth_github.htm&release=264.0.0&type=5 "In this example, configure a named credential with the OAuth 2.0 Browser Flow to make authenticated callouts to GitHub. This example uses the Named Principal identity type, meaning that a Salesforce admin authenticates to GitHub on behalf of all users in the org.").

1. From [Setup](https://help.salesforce.com/s/articleView?id=xcloud.basics_nav_setup.htm&type=5&language=en_US), use the Quick Find box to find and select **Named Credentials**.
2. Click **External Credentials**.
3. To create a new external credential, click **New**. To edit an existing external credential, click its link in the list of external credentials and then click **Edit**.
4. Complete the fields.
    
    <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
              <colgroup>
                <col style="width:25%">
                <col style="width:75%">
              </colgroup>
              <thead class="slds-text-title_caps ">
                <tr class="">
                  <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d76724e118">Field</th>
                  <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d76724e120">Description</th>
                </tr>
              </thead>
              <tbody>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d76724e118 "><strong class="uicontrol">Label</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d76724e120 ">A user-friendly name for the external credential that’s shown in the Salesforce user
                    interface, such as in list views.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d76724e118 "><strong class="uicontrol">Name</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d76724e120 ">
                    <p>A unique identifier that’s used to refer to this external credential from callout
                      definitions and through the API.</p>
                    <p style="margin-bottom:0;">The name can contain only underscores and alphanumeric
                      characters. It must be unique, begin with a letter, not include spaces, not end with an
                      underscore, and not contain two consecutive underscores.</p>
                  </td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d76724e118 "><strong class="uicontrol">Authentication Protocol</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d76724e120 ">Select <strong class="uicontrol">OAuth 2.0</strong>. </td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d76724e118 "><strong class="uicontrol">Authentication Flow Type</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d76724e120 ">Select <strong class="uicontrol">Browser Flow</strong>. See <a href="https://help.salesforce.com/s/articleView?id=xcloud.nc_auth_protocols.htm&amp;release=264.0.0&amp;type=5" title="Your connections between Salesforce and external systems use an authentication protocol to confirm secure communication between the two systems. Choose the authentication protocol that matches the configuration of the external system that you connect to. When you do, keep the strengths and considerations of each authentication protocol in mind.">Authentication Protocols for Named Credentials</a>.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d76724e118 "><strong class="uicontrol">Scope</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d76724e120 ">
                    <p>Optional. Specifies the scope of permissions to request for the access token. A
                      scope declared here is a credential-level scope that applies to all callouts that use this
                      credential. Your authentication provider determines the allowed values. See <a href="https://help.salesforce.com/s/articleView?id=remoteaccess_oauth_tokens_scopes.htm&amp;language=en_US" target="_blank">OAuth Tokens
                        and Scopes</a> and <a href="https://help.salesforce.com/s/articleView?id=sso_provider_addl_params_scope.htm&amp;language=en_US" target="_blank">Use the Scope
                        Parameter</a>.</p>
                    <p>The Scope field accepts static values and formulas. For instance, use
                      a static scope value that specifies that all callouts using this credential request have
                      offline access. Or enter a formula to request access dynamically. This example uses the
                      <code>session:role</code> scope to request credential-level
                      access based on each user’s
                      department.
                    </p>
                    <pre class="line-numbers slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium slds-scrollable_x"><code>{!"session:role:" + $User.Department}</code></pre>
                    <p>When
                      you create an external credential’s principal, you can also specify principal-level
                      scopes, which apply only per principal. For example, create a principal-level scope to
                      request access only for users that work in the Administration or Management
                      departments.</p>
                    <p>When you set the credential’s scope, keep these considerations in
                      mind.</p>
                    <ul>
                      <li>The value that you enter replaces the Default Scopes value that’s defined in the
                        specified authentication provider.</li>
                      <li>A scope can affect whether each OAuth flow prompts the user with a consent
                        screen.</li>
                      <li>We recommend that you request a refresh token or offline access. Otherwise, when the
                        token expires, you lose access to the external system.</li>
                    </ul>
                  </td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d76724e118 "><strong class="uicontrol">Identity Provider</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d76724e120 ">Select whether the external credential uses an Auth. Provider or an External Auth
                    Identity Provider to obtain OAuth tokens. Then, specify the authentication provider for
                    the external credential. See <a href="https://help.salesforce.com/s/articleView?id=xcloud.sso_authentication_providers.htm&amp;release=264.0.0&amp;type=5" title="With authentication providers, your users can log in to your Salesforce org or Experience Cloud site with single sign-on (SSO) using credentials from a third party. Authentication providers also give your users access to protected third-party data. Salesforce offers several ways to configure authentication providers, such as with OpenID Connect or with a custom OAuth 2.0 configuration. Which protocol you can use depends on the third party.">Authentication Provider SSO</a> and
                    <a href="https://help.salesforce.com/s/articleView?id=xcloud.nc_create_edit_external_auth_identity_provider.htm&amp;release=264.0.0&amp;type=5" title="If you plan to create named and external credentials that use OAuth2.0 authentication, first create an external auth identity provider. External auth identity providers obtain OAuth tokens for outbound callouts to external systems.">Create or Edit an External Auth Identity Provider</a>.
                  </td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d76724e118 "><strong class="uicontrol">Additional Status Codes for Token Refresh</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d76724e120 ">Specify HTTP status codes that trigger Salesforce to refresh expired or invalid
                    access tokens, in addition to the standard <code>401</code>
                    response.</td>
                </tr>
              </tbody>
            </table>
5. Save the external credential.

## Create Principals

After you create an external credential that uses OAuth authentication with the Browser Flow, create principals for it. You link an external credential to permission sets or user profiles through principals, and at run time, the platform ensures that the user has the permission set before accessing the remote system.

1. On the Named Credentials page, click **External Credential**.
2. Select the external credential that you created.
3. Scroll to Principals.
4. To create a principal for the external credential, click **New** or select **Edit** from the Actions menu of an existing principal.
    
    When editing an existing principal, not all the fields listed here are modifiable.
5. Enter the information for the principal.
    
    <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
                <colgroup>
                  <col style="width:25%">
                  <col style="width:75%">
                </colgroup>
                <thead class="slds-text-title_caps ">
                  <tr class="">
                    <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d76724e278">Field</th>
                    <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d76724e280">Description</th>
                  </tr>
                </thead>
                <tbody>
                  <tr class="">
                    <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d76724e278 "><strong class="uicontrol">Parameter Name</strong></td>
                    <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d76724e280 ">Enter a name for the principal, such as <kbd>Admin</kbd> or
                      <kbd>Marketing Group</kbd>.
                    </td>
                  </tr>
                  <tr class="">
                    <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d76724e278 "><strong class="uicontrol">Sequence Number</strong></td>
                    <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d76724e280 ">Assign a sequence number. A sequence number specifies the order of
                      principals to apply when a user participates in more than one principal. For
                      example, a user could be part of multiple permission sets that are applicable
                      for a credential provider. Priority is from lower to higher numbers. </td>
                  </tr>
                  <tr class="">
                    <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d76724e278 "><strong class="uicontrol">Identity Type</strong></td>
                    <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d76724e280 ">
                      <p>Choose either <strong class="uicontrol">Named Principal</strong> or <strong class="uicontrol">Per User
                          Principal</strong>. </p>
                      <p style="margin-bottom:0;">You can set up each external credential to use an
                        org-wide named principal or per-user authentication. A named principal applies
                        the same credential or authentication configuration for the entire org, while
                        per-user authentication provides access control at the individual user
                        level.</p>
                    </td>
                  </tr>
                  <tr class="">
                    <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d76724e278 "><strong class="uicontrol">Scope</strong></td>
                    <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d76724e280 ">
                      <p>Optional. Enter a principal-level scope.</p>
                      <p>This scope is in addition to the
                        optional credential-level scope. You can use it to provide access parameters
                        on a per-principal basis. For example, the credential-level scope can specify
                        offline token access, while the principal-level scope can specify access for
                        users with certain roles, such as Marketing or System Administrator.
                      </p>
                      <p>Credential-level and principal-level scopes are concatenated together
                        in callouts and sent as a space-separated list. These scopes overwrite an
                        authentication provider’s default scopes, if the appended list is
                        non-null.</p>
                      <p>This example uses a principal-level scope to link a group of
                        authenticated users to roles on an external site. The scope is <code>session:role:&lt;role&gt;</code>. If a user has Sales or
                        Service in their department name, the scope is set as <code>session:role:Sales</code> or <code>session:role:Service</code>.
                      </p>
                      <pre class="line-numbers slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium slds-scrollable_x"><code>{!IF(OR(CONTAINS($User.Department, "Sales"), CONTAINS($User.Department, "Service")), "session:role:" + $User.Department, "")}</code></pre>
                    </td>
                  </tr>
                </tbody>
              </table>
6. Save the principal.
    
    You can’t modify the Principal Name and Identity Type of an existing principal. To change these parameters, delete the principal and recreate it.
7. Now that you created the external credential and its principal, it’s time to create the connected name credential. See [Create or Edit a Named Credential](https://help.salesforce.com/s/articleView?id=xcloud.nc_create_edit_named_credential.htm&release=264.0.0&type=5 "Configure a named credential to specify the URL of a callout endpoint. To specify the required authentication parameters for the callout, connect the named credential to an external credential.").
    
    For an overview of all of the steps required to configure a named credential, see [Create Named Credentials and External Credentials](https://help.salesforce.com/s/articleView?id=xcloud.nc_named_creds_and_ext_creds.htm&release=264.0.0&type=5 "To simplify the setup of authenticated callouts, create an external credential to specify an authentication protocol and then specify a named credential as the callout endpoint. Add custom headers to cover more use cases and security requirements. Use a permission set or profile to grant access so that users can make authenticated callouts. You can create and configure named credentials programmatically or through the Salesforce UI.").

After you configure the named credential and grant access via permission sets, you must authenticate the OAuth external credential to the external system.

When the principal’s identity type is set to Named Principal, in the external credential’s Principals section, select **Authenticate** from the principal’s Actions menu. Then, authenticate yourself to the external system. For example, enter a username and password. Return to Salesforce to confirm that you want to allow your Salesforce org to interact with the external system on your behalf.

When the principal’s Identity Type is set to Per User Principal, each user authenticates to the external system from the External Credentials page in their personal settings. In the tile of the external credential to authenticate, click **Allow Access**. Authenticate to the external system, and then return to Salesforce to confirm that you want to allow your Salesforce org to interact with the external system on your behalf. After the external credential is authenticated, its tile shows Configured. To revoke authentication on an external credential, click **Revoke Access**.

#### See Also

- [Named Credentials](https://help.salesforce.com/s/articleView?id=xcloud.named_credentials_about.htm&release=264.0.0&type=5 "Intended to secure and simplify authenticated API callouts to external systems, a named credential specifies the URL of a callout endpoint and its required authentication parameters in one definition. To streamline your Apex code and simplify the setup of authenticated callouts, specify a named credential as the callout endpoint.")
- [OAuth 2.0 Client Credentials Flow for Server-to-Server Integration](https://help.salesforce.com/s/articleView?id=remoteaccess_oauth_client_credentials_flow.htm&language=en_US)