--- schema_version: "1" id: b0129217054b037d3bc5f5da3b1d87d01c1507cbd4049ed5db714070892e0698 title: Set Up JWT Claims for External Credentials collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/nc_jwt_claims.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.nc_jwt_claims.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: b198e8674e3f3fe80a2c6abd8b9f55643f09933c70bb324cb2d2b106d13e8695 description: If your external credential uses JWT authentication, configure JWT (JSON Web Token) claims. products: - Security release: "264" --- # Set Up JWT Claims for External Credentials If your external credential uses JWT authentication, configure JWT (JSON Web Token) claims. ### Required Editions
Available in: both Salesforce Classic and Lightning Experience
Available in: all editions
![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_note.png) Note This table doesn’t apply to legacy named credentials. For legacy named credentials, see [Define a Legacy Named Credential](https://help.salesforce.com/s/articleView?id=xcloud.named_credentials_define.htm&release=264.0.0&type=5 "Create a legacy named credential to specify the URL of a callout endpoint and its required authentication parameters in one definition. You can then specify the legacy named credential as a callout endpoint to let Salesforce handle all authentication. You can also skip remote site settings, which are otherwise required for callouts to external sites, for the site defined in the legacy named credential."). External credentials that use JWT authentication have JWT (JSON Web Token) claims. JWT claims assert attributes about tokens, such as time of expiration. You can modify some default claims for an external credential as well as create your own custom claims. Default JWT Claims for Named Credentials | Claim Name | Description | Notes | | --- | --- | --- | | alg | The algorithm used to sign the token. Valid values are RS256 and RS512. | Default is RS256, an asymmetric algorithm that uses a private/public pair. | | aud | (Audience) Recipient for whom the token is intended. | Added when claims are edited. Editable through the JWT Claims panel on the editable credential. | | exp | (Expiration) Time after which the token expires. Expressed as a NumericDate value, representing the number of seconds from 1970-01-01T00:00:00Z UTC until the specified UTC date/time, ignoring leap seconds. | Set on external credential creation through the **Expiration** field. If no expiration number is provided, a default of two minutes in the future is set. | | iat | (Issued At Time): Time at which the token was issued. Can be used to determine age of the token. Expressed as a NumericDate value, representing the number of seconds from 1970-01-01T00:00:00Z UTC until the specified UTC date/time, ignoring leap seconds. | Added automatically on external credential creation. Not editable. | | iss | Issuer of the token. For example, to return the Email ID, use the formula `{!$User.Email}`. | Added when claims are edited. Editable through the JWT Claims panel on the editable credential. | | kid | (Key ID) Used to match a specific key. | Added automatically on external credential creation. Editable through the JWT Claims panel on the editable credential. | | nbf | (Not Before Time) Time before which the token must not be accepted for processing. Expressed as a NumericDate value, representing the number of seconds from 1970-01-01T00:00:00Z UTC until the specified UTC date/time, ignoring leap seconds. | Added automatically on external credential creation. Not editable. | | sub | Subject of the token (the user). Supports a static value or a formula for both the Named Principal and Per User identity types. | Added when claims are edited. Editable through the JWT Claims panel on the editable credential. | | typ | (Type) The media type of the token. | Added automatically on external credential creation. The value is set to ‘JWT’. Not editable. | To modify default JWT claims or to create custom claims: 1. From [Setup](https://help.salesforce.com/s/articleView?id=xcloud.basics_nav_setup.htm&type=5&language=en_US), use the Quick Find box to find and select **Named Credentials**. 2. On the Named Credentials page, click **External Credential**. 3. Select the external credential you created. 4. Scroll to JWT Claims. 5. Click **Edit**. 6. Optionally, assign a value to these claims: **iss**, **sub**, and **aud**. You can make a callout without configuring iss, sub, and aud, and your JWT payload doesn’t contain them. However, if you edit any preset claims or add custom claims, you must provide values for all three of these claims. 7. Optionally, modify the value of the **kid** claim. You can also delete this claim. 8. Optionally, add a custom claim of your own. Provide a name, description, and value for the claim, and select either **JWT Body Claim** or **JWT Header Claim** as the type. 9. Save the edited claims. You’ve finished the main steps in creating an external credential that uses a JWT authentication protocol. Next, create the named credential. For an overview of all of the steps required to configure a named credential, see [Create Named Credentials and External Credentials](https://help.salesforce.com/s/articleView?id=xcloud.nc_named_creds_and_ext_creds.htm&release=264.0.0&type=5 "To simplify the setup of authenticated callouts, create an external credential to specify an authentication protocol and then specify a named credential as the callout endpoint. Add custom headers to cover more use cases and security requirements. Use a permission set or profile to grant access so that users can make authenticated callouts. You can create and configure named credentials programmatically or through the Salesforce UI.").