---
schema_version: "1"
id: d7196f4460050b6950219f563f7b8c3bcc663919f687c49724d2a4b9e83f0580
title: Create or Edit an OAuth External Credential with the Client Credentials with Client Secret Flow
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/nc_create_edit_oath_client_secret_ext_cred.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.nc_create_edit_oath_client_secret_ext_cred.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 13b70c970287ce9eec3c5ebd933f624b08beb23900e9776bf109570c2915d763
description: An OAuth 2.0 external credential that uses the Client Credentials with Client Secret Flow exchanges a client identifier and a client secret for an access token. The returned tokens authenticate calls to the endpoint defined in the named credential. Use the Client Credentials with Client Secret Flow when Salesforce is a client application of another external system that has its own login credentials. Instead of managing access to the external system on a per-user basis, you can set up service-level access for your Salesforce org.
products:
  - Security
release: "264"
---
# Create or Edit an OAuth External Credential with the Client Credentials with Client Secret Flow

An OAuth 2.0 external credential that uses the Client Credentials with Client Secret Flow exchanges a client identifier and a client secret for an access token. The returned tokens authenticate calls to the endpoint defined in the named credential. Use the Client Credentials with Client Secret Flow when Salesforce is a client application of another external system that has its own login credentials. Instead of managing access to the external system on a per-user basis, you can set up service-level access for your Salesforce org.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: all editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
          <colgroup>
            <col style="width:50%">
            <col style="width:50%">
          </colgroup>
          <thead class="slds-text-title_caps ">
            <tr class="">
              <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d31157e45">User Permissions
                Needed</th>
            </tr>
          </thead>
          <tbody>
            <tr class="">
              <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d31157e45 ">To view external credentials:</td>

              <td class="slds-cell-wrap" style="vertical-align:top;" headers="d31157e45 ">View Setup and Configuration</td>

            </tr>
            <tr class="">
              <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d31157e45 ">To create, edit, or delete external credentials:</td>

              <td class="slds-cell-wrap" style="vertical-align:top;" headers="d31157e45 ">Manage Named Credentials or Customize Applications</td>

            </tr>
          </tbody>
        </table>

Before you create an OAuth 2.0 external credential that uses the Client Credentials with Client Secret Flow, register Salesforce as a client application in an external system. Generate and save the client credentials—client ID and client secret—on your local machine. You need the copied values when you set up the external credential and principal in Salesforce.

1. From [Setup](https://help.salesforce.com/s/articleView?id=xcloud.basics_nav_setup.htm&type=5&language=en_US), use the Quick Find box to find and select **Named Credentials**.
2. Click **External Credentials**.
3. To create a new external credential, click **New**. To edit an existing external credential, click its link in the list of external credentials, and then click **Edit**.
4. Complete the fields.
    
    <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
              <colgroup>
                <col style="width:25%">
                <col style="width:75%">
              </colgroup>
              <thead class="slds-text-title_caps ">
                <tr class="">
                  <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d31157e110">Field</th>
                  <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d31157e112">Description</th>
                </tr>
              </thead>
              <tbody>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d31157e110 "><strong class="uicontrol">Label</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d31157e112 ">A user-friendly name for the external credential that’s shown in the Salesforce user
                    interface, such as in list views.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d31157e110 "><strong class="uicontrol">Name</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d31157e112 ">
                    <p>A unique identifier that’s used to refer to this external credential from callout
                      definitions and through the API.</p>
                    <p style="margin-bottom:0;">The name can contain only underscores and alphanumeric
                      characters. It must be unique, begin with a letter, not include spaces, not end with an
                      underscore, and not contain two consecutive underscores.</p>
                  </td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d31157e110 "><strong class="uicontrol">Authentication Protocol</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d31157e112 ">Select <strong class="uicontrol">OAuth 2.0</strong>.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d31157e110 "><strong class="uicontrol">Authentication Flow Type</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d31157e112 ">Select <strong class="uicontrol">Client Credentials with Client Secret Flow</strong>. For
                    information on the OAuth 2.0 variants, see <a href="https://help.salesforce.com/s/articleView?id=xcloud.nc_auth_protocols.htm&amp;release=264.0.0&amp;type=5" title="Your connections between Salesforce and external systems use an authentication protocol to confirm secure communication between the two systems. Choose the authentication protocol that matches the configuration of the external system that you connect to. When you do, keep the strengths and considerations of each authentication protocol in mind.">Authentication Protocols for Named Credentials</a>.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d31157e110 "><strong class="uicontrol">Scope</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d31157e112 ">
                    <p>Optional. Specifies the scope of permissions to request for the access token. This
                      scope applies to all callouts that use this credential. Your authentication provider
                      determines the allowed values. See <a href="https://help.salesforce.com/s/articleView?id=remoteaccess_oauth_tokens_scopes.htm&amp;language=en_US" target="_blank">OAuth Tokens
                        and Scopes</a> and <a href="https://help.salesforce.com/s/articleView?id=sso_provider_addl_params_scope.htm&amp;language=en_US" target="_blank">Use the Scope
                        Parameter</a>.</p>
                    <p>The Scope field accepts static values and formulas. This example uses
                      the <code>session:role</code> scope to request access based on
                      each user’s
                      department.</p>
                    <pre class="line-numbers slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium slds-scrollable_x"><code>{!"session:role:" + $User.Department}</code></pre>
                    <p>When
                      you set the credential’s scope, keep these considerations in mind.</p>
                    <ul>
                      <li>The value that you enter replaces the Default Scopes value that’s defined in the
                        specified authentication provider.</li>
                      <li>A scope can affect whether each OAuth flow prompts the user with a consent
                        screen.</li>
                    </ul>
                  </td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d31157e110 "><strong class="uicontrol">Identity Provider URL</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d31157e112 ">The URL of the identity provider to send the client credentials to in exchange for
                    an access token.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d31157e110 "><strong class="uicontrol">Pass client credentials in request body</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d31157e112 ">
                    <p>Optional. Sends the client ID and client secret in the callout’s request body
                      instead of its header.</p>
                    <p>By default, client credentials are sent in the callout’s
                      authorization header, as with Basic authentication. With this format, the
                      <var>client_id</var> is appended to the <var>client_secret</var> in the
                      format <code><var>client_id</var>:<var>client_secret</var></code>, and the
                      resulting value is Base64-encoded.
                    </p>
                    <p style="margin-bottom:0;">Sending client credentials in the authorization
                      header aligns with section <a href="https://www.rfc-editor.org/rfc/rfc6749#section-2.3.1" target="_blank">2.3.1 Client Password</a> in <cite>The OAuth
                        2.0 Authorization Framework</cite> from the Internet Engineering Task Force.&nbsp;If the
                      external system requires that you pass client credentials in the request body instead,
                      use this option.</p>
                  </td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d31157e110 "><strong class="uicontrol">Additional Status Codes for Token Refresh</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d31157e112 ">Specify HTTP status codes that trigger Salesforce to refresh expired or invalid
                    access tokens, in addition to the standard <code>401</code>
                    response.</td>
                </tr>
              </tbody>
            </table>
5. Save the external credential.

## Create Principals

After you create an external credential that uses the OAuth Client Credentials with Client Secret Flow, create principals for it. You link an external credential to permission sets or user profiles through principals, and at run time, the platform ensures that the user has the permission set before accessing the remote system.

Principals that authenticate with Client Credentials with Client Secret use the Named Principal identity type automatically because the authentication configuration is applied at the service level.

1. On the Named Credentials page, click **External Credential**.
2. Select the external credential that you created.
3. Scroll to Principals.
4. To create a principal for the external credential, click **New** or select **Edit** from the Actions menu of an existing principal.
    
    When editing an existing principal, not all the fields listed here are modifiable.
5. Enter the information for the principal.
    
     
    | Field | Description |
    | --- | --- |
    | **Parameter Name** | Enter a name for the principal, such as Admin or Marketing Group. |
    | **Sequence Number** | Assign a sequence number. A sequence number specifies the order of principals to apply when a user participates in more than one principal. For example, a user could be part of multiple permission sets that are applicable for a credential provider. Priority is from lower to higher numbers. |
    | **Client ID** | Enter the unique identifier that is used to authenticate the client. |
    | **Client Secret** | Enter the secret for your client. |
    
    ![Tip](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_tip.png)
    
    Tip Client secrets often contain special characters. If your client ID or client secret contains special characters, you must URL-encode it before you save it in your principal.
6. Save the principal.
    
    You can’t modify the Principal Name and Identity Type of an existing principal. To change these parameters, delete the principal and recreate it.
7. Now that you created the external credential and its principal, it’s time to create the connected name credential. See [Create or Edit a Named Credential](https://help.salesforce.com/s/articleView?id=xcloud.nc_create_edit_named_credential.htm&release=264.0.0&type=5 "Configure a named credential to specify the URL of a callout endpoint. To specify the required authentication parameters for the callout, connect the named credential to an external credential.").
    
    For an overview of all of the steps required to configure a named credential, see [Create Named Credentials and External Credentials](https://help.salesforce.com/s/articleView?id=xcloud.nc_named_creds_and_ext_creds.htm&release=264.0.0&type=5 "To simplify the setup of authenticated callouts, create an external credential to specify an authentication protocol and then specify a named credential as the callout endpoint. Add custom headers to cover more use cases and security requirements. Use a permission set or profile to grant access so that users can make authenticated callouts. You can create and configure named credentials programmatically or through the Salesforce UI.").

#### See Also

- [Named Credentials](https://help.salesforce.com/s/articleView?id=xcloud.named_credentials_about.htm&release=264.0.0&type=5 "Intended to secure and simplify authenticated API callouts to external systems, a named credential specifies the URL of a callout endpoint and its required authentication parameters in one definition. To streamline your Apex code and simplify the setup of authenticated callouts, specify a named credential as the callout endpoint.")
- [OAuth 2.0 Client Credentials Flow for Server-to-Server Integration](https://help.salesforce.com/s/articleView?id=remoteaccess_oauth_client_credentials_flow.htm&language=en_US)