---
schema_version: "1"
id: 0dfcf9715001b40579b6ecb7626e8634e6b1326e381818c22da9cc2e256ecc13
title: Create or Edit an OAuth External Credential with the Client Credentials Flow Managed by an External Identity Provider
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/nc_create_edit_oath_client_cred_xidp_ext_cred.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.nc_create_edit_oath_client_cred_xidp_ext_cred.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: b69aaa06a22bf636ae075932667025d6cef3390d4caf27ba1c4e5a5c72a2f2b2
description: An OAuth 2.0 external credential that uses Client Credentials Flow Managed by an External Auth Identity Provider uses the client identification configured in the linked external auth identity provider.
products:
  - Security
release: "264"
---
# Create or Edit an OAuth External Credential with the Client Credentials Flow Managed by an External Identity Provider

An OAuth 2.0 external credential that uses Client Credentials Flow Managed by an External Auth Identity Provider uses the client identification configured in the linked external auth identity provider.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: all editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
          <colgroup>
            <col style="width:50%">
            <col style="width:50%">
          </colgroup>
          <thead class="slds-text-title_caps ">
            <tr class="">
              <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d70611e62">User Permissions
                Needed</th>
            </tr>
          </thead>
          <tbody>
            <tr class="">
              <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d70611e62 ">To view external credentials:</td>

              <td class="slds-cell-wrap" style="vertical-align:top;" headers="d70611e62 ">View Setup and Configuration</td>

            </tr>
            <tr class="">
              <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d70611e62 ">To create, edit, or delete external credentials:</td>

              <td class="slds-cell-wrap" style="vertical-align:top;" headers="d70611e62 ">Manage Named Credentials or Customize Applications</td>

            </tr>
          </tbody>
        </table>

The external auth identity provider feature within Named Credentials enables Salesforce to delegate the authentication process to an external identity provider like Okta, Microsoft Entra ID (formerly Azure AD), and others. Before you create an OAuth 2.0 external credential that uses an external auth identity provider, you first must configure the external auth identity provider. See [Create or Edit an External Auth Identity Provider](https://help.salesforce.com/s/articleView?id=xcloud.nc_create_edit_external_auth_identity_provider.htm&release=264.0.0&type=5 "If you plan to create named and external credentials that use OAuth2.0 authentication, first create an external auth identity provider. External auth identity providers obtain OAuth tokens for outbound callouts to external systems."). You’ll need the client ID and client secret during that process.

1. From [Setup](https://help.salesforce.com/s/articleView?id=xcloud.basics_nav_setup.htm&type=5&language=en_US), use the Quick Find box to find and select **Named Credentials**.
2. Click **External Credentials**.
3. To create a new external credential, click **New**. To edit an existing external credential, click its link in the list of external credentials, and then click **Edit**.
4. Complete the fields.
    
    <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
              <colgroup>
                <col style="width:25%">
                <col style="width:75%">
              </colgroup>
              <thead class="slds-text-title_caps ">
                <tr class="">
                  <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d70611e156">Field</th>
                  <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d70611e159">Description</th>
                </tr>
              </thead>
              <tbody>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d70611e156 "><strong class="uicontrol">Label</strong></td>

                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d70611e159 ">A user-friendly name for the external credential that’s shown in the Salesforce user
                    interface, such as in list views.</td>

                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d70611e156 "><strong class="uicontrol">Name</strong></td>

                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d70611e159 ">
                    <p>A unique identifier that’s used to refer to this external credential from callout
                      definitions and through the API.</p>
                    <p style="margin-bottom:0;">The name can contain only underscores and alphanumeric
                      characters. It must be unique, begin with a letter, not include spaces, not end with an
                      underscore, and not contain two consecutive underscores.</p>
                  </td>

                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d70611e156 "><strong class="uicontrol">Authentication Protocol</strong></td>

                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d70611e159 ">Select <strong class="uicontrol">OAuth 2.0</strong>.</td>

                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d70611e156 "><strong class="uicontrol">Authentication Flow Type</strong></td>

                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d70611e159 ">Select <strong class="uicontrol">Client Credentials Flow Managed by External Identity
                      Provider</strong>. For information on the OAuth 2.0 variants, see <a href="https://help.salesforce.com/s/articleView?id=xcloud.nc_auth_protocols.htm&amp;release=264.0.0&amp;type=5" title="Your connections between Salesforce and external systems use an authentication protocol to confirm secure communication between the two systems. Choose the authentication protocol that matches the configuration of the external system that you connect to. When you do, keep the strengths and considerations of each authentication protocol in mind.">Authentication Protocols for Named Credentials</a>.</td>

                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d70611e156 "><strong class="uicontrol">Scope</strong></td>

                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d70611e159 ">
                    <p>Optional. Specifies the scope of permissions to request for the access token. This
                      scope applies to all callouts that use this credential. Your authentication provider
                      determines the allowed values. See <a href="https://help.salesforce.com/s/articleView?id=remoteaccess_oauth_tokens_scopes.htm&amp;language=en_US" target="_blank">OAuth Tokens and Scopes</a> and <a href="https://help.salesforce.com/s/articleView?id=sso_provider_addl_params_scope.htm&amp;language=en_US" target="_blank">Use the Scope Parameter</a>.</p>
                    <p>The Scope field accepts
                      static values and formulas. This example uses the <code>session:role</code> scope to
                      request access based on each user’s
                      department.</p>
                    <pre class="line-numbers slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium slds-scrollable_x"><code>{!"session:role:" + $User.Department}</code></pre>
                    <p>When you
                      set the credential’s scope, keep these considerations in mind.</p>
                    <ul>
                      <li>The value that you enter replaces the Default Scopes value that’s defined in the
                        specified authentication provider.</li>

                      <li>A scope can affect whether each OAuth flow prompts the user with a consent
                        screen.</li>

                    </ul>
                  </td>

                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d70611e156 "><strong class="uicontrol">External Auth Identity Provider</strong></td>

                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d70611e159 ">Select an external auth identity provider you previously configured.</td>

                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d70611e156 "><strong class="uicontrol">Pass client credentials in request body</strong></td>

                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d70611e159 ">
                    <p>Optional. Sends the client ID and client secret in the callout’s request body
                      instead of its header.</p>
                    <p>By default, client credentials are sent in the callout’s
                      authorization header, as with Basic authentication. With this format, the
                      <var>client_id</var> is appended to the <var>client_secret</var> in the
                      format <code><var>client_id</var>:<var>client_secret</var></code>,
                      and the resulting value is Base64-encoded.
                    </p>
                    <p style="margin-bottom:0;">Sending client credentials in the
                      authorization header aligns with section <a href="https://www.rfc-editor.org/rfc/rfc6749#section-2.3.1" target="_blank">2.3.1 Client Password</a> in <cite>The OAuth 2.0 Authorization
                        Framework</cite> from the Internet Engineering Task Force.&nbsp;If the external system
                      requires that you pass client credentials in the request body instead, use this
                      option.</p>
                  </td>

                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d70611e156 "><strong class="uicontrol">Additional Status Codes for Token Refresh</strong></td>

                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d70611e159 ">Specify HTTP status codes that trigger Salesforce to refresh expired or invalid
                    access tokens, in addition to the standard <code>401</code> response.</td>

                </tr>
              </tbody>
            </table>
5. Save the external credential.

## Create Principals

After you create an external credential that uses the external auth identity provider you configured, create principals for it. You link the external credential to permission sets or user profiles through principals, and at run time, the platform ensures that the user has the permission set before accessing the remote system.

Principals that authenticate with Client Credentials with Client Secret use the Named Principal identity type automatically because the authentication configuration is applied at the service level.

1. On the Named Credentials page, click **External Credential**.
2. Select the external credential that you created.
3. Scroll to Principals.
4. To create a principal for the external credential, click **New** or select **Edit** from the Actions menu of an existing principal.
    
    When editing an existing principal, not all the fields listed here are modifiable.
5. Enter the information for the principal.
    
     
    | Field | Description |
    | --- | --- |
    | **Parameter Name** | Enter a name for the principal, such as Admin or Marketing Group. |
    | **Sequence Number** | Assign a sequence number. A sequence number specifies the order of principals to apply when a user participates in more than one principal. For example, a user could be part of multiple permission sets that are applicable for a credential provider. Priority is from lower to higher numbers. |
    | **Client ID** | The client ID is auto-populated from the external auth identity provider. |
    | **Client Secret** | The secret is auto-populated from the external auth identity provider. |
6. Save the principal.
    
    You can’t modify the Principal Name and Identity Type of an existing principal. To change these parameters, delete the principal and recreate it.
7. To allow a user to use the external credential, edit the permission set. Enable the external credential principal in the permission set. See [Enable User External Credentials](https://help.salesforce.com/s/articleView?id=xcloud.nc_user_external_credentials.htm&release=264.0.0&type=5 "Tokens for named credential callouts are encrypted and stored in the User External Credential object. Any user performing an authenticated callout needs profile- or permission set-based access to user external credentials. Most standard permission sets and profiles have access to the User External Credentials object by default. For the guest user profile, and for some custom permission sets and profiles, you must assign User External Credentials object permissions manually.").
8. Now that you created the external credential and its principal, it’s time to create the connected name credential. See [Create or Edit a Named Credential](https://help.salesforce.com/s/articleView?id=xcloud.nc_create_edit_named_credential.htm&release=264.0.0&type=5 "Configure a named credential to specify the URL of a callout endpoint. To specify the required authentication parameters for the callout, connect the named credential to an external credential.").
    
    For an overview of all of the steps required to configure a named credential, see [Create Named Credentials and External Credentials](https://help.salesforce.com/s/articleView?id=xcloud.nc_named_creds_and_ext_creds.htm&release=264.0.0&type=5 "To simplify the setup of authenticated callouts, create an external credential to specify an authentication protocol and then specify a named credential as the callout endpoint. Add custom headers to cover more use cases and security requirements. Use a permission set or profile to grant access so that users can make authenticated callouts. You can create and configure named credentials programmatically or through the Salesforce UI.").