---
schema_version: "1"
id: 7e15073928cf3a9ca8c61a6bd564e7c385f990c9256e5a9d317dfcdf64361f6a
title: Create or Edit an OAuth External Credential with the JWT Bearer Flow
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/nc_create_edit_oath_jwt_bearer_ext_cred.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.nc_create_edit_oath_jwt_bearer_ext_cred.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 725ef27f4d8dfd59e82e3cf697271bf378dbb15860c72d949815f6ed868e4fcb
description: An OAuth 2.0 external credential that uses the JWT Bearer Flow sends a JWT (JSON Web Token) to an authorization provider in exchange for a token. The returned tokens authenticate calls to the endpoint defined in the named credential.
products:
  - Security
release: "264"
---
# Create or Edit an OAuth External Credential with the JWT Bearer Flow

An OAuth 2.0 external credential that uses the JWT Bearer Flow sends a JWT (JSON Web Token) to an authorization provider in exchange for a token. The returned tokens authenticate calls to the endpoint defined in the named credential.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: all editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
          <colgroup>
            <col style="width:50%">
            <col style="width:50%">
          </colgroup>
          <thead class="slds-text-title_caps ">
            <tr class="">
              <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d68147e45">User Permissions
                Needed</th>
            </tr>
          </thead>
          <tbody>
            <tr class="">
              <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d68147e45 ">To view external credentials:</td>

              <td class="slds-cell-wrap" style="vertical-align:top;" headers="d68147e45 ">View Setup and Configuration</td>

            </tr>
            <tr class="">
              <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d68147e45 ">To create, edit, or delete external credentials:</td>

              <td class="slds-cell-wrap" style="vertical-align:top;" headers="d68147e45 ">Manage Named Credentials or Customize Applications</td>

            </tr>
          </tbody>
        </table>

1. From [Setup](https://help.salesforce.com/s/articleView?id=xcloud.basics_nav_setup.htm&type=5&language=en_US), use the Quick Find box to find and select **Named Credentials**.
2. Click **External Credentials**.
3. To create a new external credential, click **New**. To edit an existing external credential, click its link in the list of external credentials and then click **Edit**.
4. Complete the fields.
    
    <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
              <colgroup>
                <col style="width:25%">
                <col style="width:75%">
              </colgroup>
              <thead class="slds-text-title_caps ">
                <tr class="">
                  <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d68147e108">Field</th>
                  <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d68147e110">Description</th>
                </tr>
              </thead>
              <tbody>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d68147e108 "><strong class="uicontrol">Label</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d68147e110 ">A user-friendly name for the external credential that’s shown in the Salesforce user
                    interface, such as in list views.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d68147e108 "><strong class="uicontrol">Name</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d68147e110 ">
                    <p>A unique identifier that’s used to refer to this external credential from callout
                      definitions and through the API.</p>
                    <p style="margin-bottom:0;">The name can contain only underscores and alphanumeric
                      characters. It must be unique, begin with a letter, not include spaces, not end with an
                      underscore, and not contain two consecutive underscores.</p>
                  </td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d68147e108 "><strong class="uicontrol">Authentication Protocol</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d68147e110 ">Select <strong class="uicontrol">OAuth 2.0</strong>.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d68147e108 "><strong class="uicontrol">Authentication Flow Type</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d68147e110 ">Select <strong class="uicontrol">JWT Bearer Flow</strong>. See <a href="https://help.salesforce.com/s/articleView?id=xcloud.nc_auth_protocols.htm&amp;release=264.0.0&amp;type=5" title="Your connections between Salesforce and external systems use an authentication protocol to confirm secure communication between the two systems. Choose the authentication protocol that matches the configuration of the external system that you connect to. When you do, keep the strengths and considerations of each authentication protocol in mind.">Authentication Protocols for Named Credentials</a>.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d68147e108 "><strong class="uicontrol">Scope</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d68147e110 ">
                    <p>Optional. Specifies the scope of permissions to request for the access token. A
                      scope declared here is a credential-level scope that applies to all callouts that use this
                      credential. Your authentication provider determines the allowed values. See <a href="https://help.salesforce.com/s/articleView?id=remoteaccess_oauth_tokens_scopes.htm&amp;language=en_US" target="_blank">OAuth Tokens
                        and Scopes</a> and <a href="https://help.salesforce.com/s/articleView?id=sso_provider_addl_params_scope.htm&amp;language=en_US" target="_blank">Use the Scope
                        Parameter</a>.</p>
                    <p>The Scope field accepts static values and formulas. This example uses
                      the <code>session:role</code> scope to request access dynamically
                      based on each user’s
                      department.</p>
                    <pre class="line-numbers slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium slds-scrollable_x"><code>{!"session:role:" + $User.Department}</code></pre>
                    <p>When
                      you set the credential’s scope, keep these considerations in mind.</p>
                    <ul>
                      <li>The value that you enter replaces the Default Scopes value that’s defined in the
                        specified authentication provider.</li>
                      <li>A scope can affect whether each OAuth flow prompts the user with a consent
                        screen.</li>
                    </ul>
                  </td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d68147e108 "><strong class="uicontrol" id="nc_create_edit_oath_jwt_bearer_ext_cred__id_provider"><a name="nc_create_edit_oath_jwt_bearer_ext_cred__id_provider"><!-- --></a>Identity Provider URL</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d68147e110 ">The URL of the identity provider to send the JWT (JSON Web Token) to in exchange for
                    an access token.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d68147e108 "><strong class="uicontrol">Signing Certificate</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d68147e110 ">A certificate from an identity provider, via a CA (certificate authority), or
                    registered with an identity provider, and uploaded to Salesforce through Certificate and
                    Key Management.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d68147e108 "><strong class="uicontrol">Signing Algorithm</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d68147e110 ">Select from RS256 (default) or RS512.</td>
                </tr>
                <tr class="">
                  <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d68147e108 "><strong class="uicontrol">Additional Status Codes for Token Refresh</strong></td>
                  <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d68147e110 ">Specify HTTP status codes that trigger Salesforce to refresh expired or invalid
                    access tokens, in addition to the standard <code>401</code>
                    response.</td>
                </tr>
              </tbody>
            </table>
5. (Optional) Modify some default JWT claims for an external credential or create your own custom claims.
    
    External credentials that use JWT authentication have JWT claims that assert attributes about tokens, such as time of expiration. See [Set Up JWT Claims for Named Credentials](https://help.salesforce.com/s/articleView?id=xcloud.nc_jwt_claims.htm&release=264.0.0&type=5 "If your external credential uses JWT authentication, configure JWT (JSON Web Token) claims.").
6. Save the external credential.

## Create Principals

After you create an external credential that uses OAuth authentication with the JWT Bearer Flow, create principals for it. You link an external credential to permission sets or user profiles through principals, and at run time, the platform ensures that the user has the permission set before accessing the remote system.

1. On the Named Credentials page, click **External Credential**.
2. Select the external credential that you created.
3. Scroll to Principals.
4. To create a principal for the external credential, click **New** or select **Edit** from the Actions menu of an existing principal.
    
    When editing an existing principal, not all the fields listed here are modifiable.
5. Enter the information for the principal.
    
    <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
                <colgroup>
                  <col style="width:25%">
                  <col style="width:75%">
                </colgroup>
                <thead class="slds-text-title_caps ">
                  <tr class="">
                    <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d68147e274">Field</th>
                    <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d68147e276">Description</th>
                  </tr>
                </thead>
                <tbody>
                  <tr class="">
                    <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d68147e274 "><strong class="uicontrol">Parameter Name</strong></td>
                    <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d68147e276 ">Enter a name for the principal, such as <kbd>Admin</kbd> or
                      <kbd>Marketing Group</kbd>.
                    </td>
                  </tr>
                  <tr class="">
                    <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d68147e274 "><strong class="uicontrol">Sequence Number</strong></td>
                    <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d68147e276 ">Assign a sequence number. A sequence number specifies the order of
                      principals to apply when a user participates in more than one principal. For
                      example, a user could be part of multiple permission sets that are applicable
                      for a credential provider. Priority is from lower to higher numbers.</td>
                  </tr>
                  <tr class="">
                    <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d68147e274 "><strong class="uicontrol">Identity Type</strong></td>
                    <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d68147e276 ">
                      <p>Choose either <strong class="uicontrol">Named Principal</strong> or <strong class="uicontrol">Per User
                          Principal</strong>.</p>
                      <p style="margin-bottom:0;">You can set up each external credential to use an
                        org-wide named principal or per-user authentication. A named principal applies
                        the same credential or authentication configuration for the entire org, while
                        per-user authentication provides access control at the individual user
                        level.</p>
                    </td>
                  </tr>
                  <tr class="">
                    <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d68147e274 "><strong class="uicontrol">Scope</strong></td>
                    <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d68147e276 ">
                      <p>Optional. To provide access parameters on a per-principal basis, enter a
                        principal-level scope. This scope is in addition to the optional
                        credential-level scope.</p>
                      <p>Credential-level and principal-level scopes are
                        concatenated together in callouts and sent as a space-separated list. These
                        scopes overwrite an authentication provider’s default scopes, if the appended
                        list is non-null.</p>
                      <p>This example uses a principal-level scope to link a
                        group of authenticated users to roles on an external site. The scope is
                        <code>session:role:&lt;role&gt;</code>. If a user has
                        Sales or Service in their department name, the scope is set as <code>session:role:Sales</code> or <code>session:role:Service</code>.
                      </p>
                      <pre class="line-numbers slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium slds-scrollable_x"><code>{!IF(OR(CONTAINS($User.Department, "Sales"), CONTAINS($User.Department, "Service")), "session:role:" + $User.Department, "")}</code></pre>
                    </td>
                  </tr>
                </tbody>
              </table>
6. Save the principal.
    
    You can’t modify the Principal Name and Identity Type of an existing principal. To change these parameters, delete the principal and recreate it.
7. Now that you created the external credential and its principal, it’s time to create the connected name credential. See [Create or Edit a Named Credential](https://help.salesforce.com/s/articleView?id=xcloud.nc_create_edit_named_credential.htm&release=264.0.0&type=5 "Configure a named credential to specify the URL of a callout endpoint. To specify the required authentication parameters for the callout, connect the named credential to an external credential.").
    
    For an overview of all of the steps required to configure a named credential, see [Create Named Credentials and External Credentials](https://help.salesforce.com/s/articleView?id=xcloud.nc_named_creds_and_ext_creds.htm&release=264.0.0&type=5 "To simplify the setup of authenticated callouts, create an external credential to specify an authentication protocol and then specify a named credential as the callout endpoint. Add custom headers to cover more use cases and security requirements. Use a permission set or profile to grant access so that users can make authenticated callouts. You can create and configure named credentials programmatically or through the Salesforce UI.").

#### See Also

- [Named Credentials](https://help.salesforce.com/s/articleView?id=xcloud.named_credentials_about.htm&release=264.0.0&type=5 "Intended to secure and simplify authenticated API callouts to external systems, a named credential specifies the URL of a callout endpoint and its required authentication parameters in one definition. To streamline your Apex code and simplify the setup of authenticated callouts, specify a named credential as the callout endpoint.")
- [OAuth 2.0 Client Credentials Flow for Server-to-Server Integration](https://help.salesforce.com/s/articleView?id=remoteaccess_oauth_client_credentials_flow.htm&language=en_US)