---
schema_version: "1"
id: 33d795d554b111908026fd116e53b760c24db999fae97fe7870c8513b2104849
title: Create or Edit an OAuth External Credential with the Client Credentials with JWT Assertion Flow
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/nc_create_edit_oath_jwt_assertion_ext_cred.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.nc_create_edit_oath_jwt_assertion_ext_cred.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 7e8a515bf1f5e3178df4cfda8b9bb416af86482e6f167c6c33ff2baa543e22c1
description: An OAuth 2.0 external credential that uses the JWT Assertion Flow exchanges client credentials defined in a client identifier and in a JSON Web Token (JWT) assertion for an access token. The returned tokens authenticate calls to the endpoint defined in the named credential.
products:
  - Security
release: "264"
---
# Create or Edit an OAuth External Credential with the Client Credentials with JWT Assertion Flow

An OAuth 2.0 external credential that uses the JWT Assertion Flow exchanges client credentials defined in a client identifier and in a JSON Web Token (JWT) assertion for an access token. The returned tokens authenticate calls to the endpoint defined in the named credential.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: all editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
          <colgroup>
            <col style="width:50%">
            <col style="width:50%">
          </colgroup>
          <thead class="slds-text-title_caps ">
            <tr class="">
              <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d41355e45">User Permissions
                Needed</th>
            </tr>
          </thead>
          <tbody>
            <tr class="">
              <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d41355e45 ">To view external credentials:</td>

              <td class="slds-cell-wrap" style="vertical-align:top;" headers="d41355e45 ">View Setup and Configuration</td>

            </tr>
            <tr class="">
              <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d41355e45 ">To create, edit, or delete external credentials:</td>

              <td class="slds-cell-wrap" style="vertical-align:top;" headers="d41355e45 ">Manage Named Credentials or Customize Applications</td>

            </tr>
          </tbody>
        </table>

1. From [Setup](https://help.salesforce.com/s/articleView?id=xcloud.basics_nav_setup.htm&type=5&language=en_US), use the Quick Find box to find and select **Named Credentials**.
2. Click **External Credentials**.
3. To create a new external credential, click **New**. To edit an existing external credential, click its link in the list of external credentials and then click **Edit**.
4. Complete the fields.
    
    <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
              <colgroup>
                <col style="width:25%">
                <col style="width:75%">
              </colgroup>
              <thead class="slds-text-title_caps ">
                <tr class="">
                  <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d41355e108">Field</th>
                  <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d41355e110">Description</th>
                </tr>
              </thead>
              <tbody>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d41355e108 "><strong class="uicontrol">Label</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d41355e110 ">A user-friendly name for the external credential that’s shown in the Salesforce user
                    interface, such as in list views.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d41355e108 "><strong class="uicontrol">Name</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d41355e110 ">
                    <p>A unique identifier that’s used to refer to this external credential from callout
                      definitions and through the API.</p>
                    <p style="margin-bottom:0;">The name can contain only underscores and alphanumeric
                      characters. It must be unique, begin with a letter, not include spaces, not end with an
                      underscore, and not contain two consecutive underscores.</p>
                  </td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d41355e108 "><strong class="uicontrol">Authentication Protocol</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d41355e110 ">Select <strong class="uicontrol">OAuth 2.0</strong>.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d41355e108 "><strong class="uicontrol">Authentication Flow Type</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d41355e110 ">Select <strong class="uicontrol">Client Credentials with JWT Assertion Flow</strong>. See <a href="https://help.salesforce.com/s/articleView?id=xcloud.nc_auth_protocols.htm&amp;release=264.0.0&amp;type=5" title="Your connections between Salesforce and external systems use an authentication protocol to confirm secure communication between the two systems. Choose the authentication protocol that matches the configuration of the external system that you connect to. When you do, keep the strengths and considerations of each authentication protocol in mind.">Authentication Protocols for Named Credentials</a>.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d41355e108 "><strong class="uicontrol">Scope</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d41355e110 ">
                    <p>Optional. Specifies the scope of permissions to request for the access token. This
                      scope applies to all callouts that use this credential. Your authentication provider
                      determines the allowed values. See <a href="https://help.salesforce.com/s/articleView?id=remoteaccess_oauth_tokens_scopes.htm&amp;language=en_US" target="_blank">OAuth Tokens
                        and Scopes</a> and <a href="https://help.salesforce.com/s/articleView?id=sso_provider_addl_params_scope.htm&amp;language=en_US" target="_blank">Use the Scope
                        Parameter</a>.</p>
                    <p>The Scope field accepts static values and formulas. This example uses
                      the <code>session:role</code> scope to request access based on
                      each user’s
                      department.</p>
                    <pre class="line-numbers slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium slds-scrollable_x"><code>{!"session:role:" + $User.Department}</code></pre>
                    <p>When
                      you set the credential’s scope, keep these considerations in mind.</p>
                    <ul>
                      <li>The value that you enter replaces the Default Scopes value that’s defined in the
                        specified authentication provider.</li>
                      <li>A scope can affect whether each OAuth flow prompts the user with a consent
                        screen.</li>
                    </ul>
                  </td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d41355e108 "><strong class="uicontrol" id="nc_create_edit_oath_jwt_assertion_ext_cred__id_provider"><a name="nc_create_edit_oath_jwt_assertion_ext_cred__id_provider"><!-- --></a>Identity Provider URL</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d41355e110 ">The URL of the identity provider to send the JWT to in exchange for an access
                    token.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d41355e108 "><strong class="uicontrol">Signing Certificate</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d41355e110 ">A certificate from an identity provider, via a CA (certificate authority), or
                    registered with an identity provider, and uploaded to Salesforce through Certificate and
                    Key Management.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d41355e108 "><strong class="uicontrol">Signing Algorithm</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d41355e110 ">Select from <strong class="uicontrol">RS256</strong> (default) or
                    <strong class="uicontrol">RS512</strong>.
                  </td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d41355e108 "><strong class="uicontrol">Additional Status Codes for Token Refresh</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d41355e110 ">Specify HTTP status codes that trigger Salesforce to refresh expired or invalid
                    access tokens, in addition to the standard <code>401</code>
                    response.</td>
                </tr>
              </tbody>
            </table>
5. (Optional) Modify some default JWT claims for an external credential or create your own custom claims.
    
    External credentials that use JWT authentication have JWT claims that assert attributes about tokens, such as time of expiration. See [Set Up JWT Claims for Named Credentials](https://help.salesforce.com/s/articleView?id=xcloud.nc_jwt_claims.htm&release=264.0.0&type=5 "If your external credential uses JWT authentication, configure JWT (JSON Web Token) claims.").
6. Save the external credential.

## Create Principals

After you create an external credential that uses the OAuth 2.0 Client Credentials with JWT Assertion Flow, create principals for it. You link an external credential to permission sets or user profiles through principals, and at run time, the platform ensures that the user has the permission set before accessing the remote system.

Principals that authenticate with JWT use the Named Principal identity type automatically because the authentication configuration is applied at the service level.

1. On the Named Credentials page, click **External Credential**.
2. Select the external credential that you created.
3. Scroll to Principals.
4. To create a principal for the external credential, click **New** or select **Edit** from the Actions menu of an existing principal.
    
    When editing an existing principal, not all the fields listed here are modifiable.
5. Enter the information for the principal.
    
     
    | Field | Description |
    | --- | --- |
    | **Parameter Name** | Enter a name for the principal, such as Admin or Marketing Group. |
    | **Sequence Number** | Assign a sequence number. A sequence number specifies the order of principals to apply when a user participates in more than one principal. For example, a user could be part of multiple permission sets that are applicable for a credential provider. Priority is from lower to higher numbers. |
    | **Client ID** | Enter the unique identifier that is used to authenticate the client. |
6. Save the principal.
    
    You can’t modify the Principal Name and Identity Type of an existing principal. To change these parameters, delete the principal and recreate it.
7. Now that you created the external credential and its principal, it’s time to create the connected name credential. See [Create or Edit a Named Credential](https://help.salesforce.com/s/articleView?id=xcloud.nc_create_edit_named_credential.htm&release=264.0.0&type=5 "Configure a named credential to specify the URL of a callout endpoint. To specify the required authentication parameters for the callout, connect the named credential to an external credential.").
    
    For an overview of all of the steps required to configure a named credential, see [Create Named Credentials and External Credentials](https://help.salesforce.com/s/articleView?id=xcloud.nc_named_creds_and_ext_creds.htm&release=264.0.0&type=5 "To simplify the setup of authenticated callouts, create an external credential to specify an authentication protocol and then specify a named credential as the callout endpoint. Add custom headers to cover more use cases and security requirements. Use a permission set or profile to grant access so that users can make authenticated callouts. You can create and configure named credentials programmatically or through the Salesforce UI.").

#### See Also

- [Named Credentials](https://help.salesforce.com/s/articleView?id=xcloud.named_credentials_about.htm&release=264.0.0&type=5 "Intended to secure and simplify authenticated API callouts to external systems, a named credential specifies the URL of a callout endpoint and its required authentication parameters in one definition. To streamline your Apex code and simplify the setup of authenticated callouts, specify a named credential as the callout endpoint.")
- [OAuth 2.0 Client Credentials Flow for Server-to-Server Integration](https://help.salesforce.com/s/articleView?id=remoteaccess_oauth_client_credentials_flow.htm&language=en_US)