External credentials support four different variants of the OAuth authentication protocol.
Required Editions
| Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience |
| Available in: all editions |
- Create or Edit an OAuth External Credential with the Browser Flow
With an OAuth 2.0 external credential that uses the Browser Flow, one or more users logs into the remote system via a web browser to trigger a callback that includes access tokens. The returned tokens authenticate calls to the endpoint defined in the named credential. - Create or Edit an OAuth External Credential with the Client Credentials with Client Secret Flow
An OAuth 2.0 external credential that uses the Client Credentials with Client Secret Flow exchanges a client identifier and a client secret for an access token. The returned tokens authenticate calls to the endpoint defined in the named credential. Use the Client Credentials with Client Secret Flow when Salesforce is a client application of another external system that has its own login credentials. Instead of managing access to the external system on a per-user basis, you can set up service-level access for your Salesforce org. - Create or Edit an OAuth External Credential with the Client Credentials Flow Managed by an External Identity Provider
An OAuth 2.0 external credential that uses Client Credentials Flow Managed by an External Auth Identity Provider uses the client identification configured in the linked external auth identity provider. - Create or Edit an OAuth External Credential with the Client Credentials with JWT Assertion Flow
An OAuth 2.0 external credential that uses the JWT Assertion Flow exchanges client credentials defined in a client identifier and in a JSON Web Token (JWT) assertion for an access token. The returned tokens authenticate calls to the endpoint defined in the named credential. - Create or Edit an OAuth External Credential with the JWT Bearer Flow
An OAuth 2.0 external credential that uses the JWT Bearer Flow sends a JWT (JSON Web Token) to an authorization provider in exchange for a token. The returned tokens authenticate calls to the endpoint defined in the named credential.