---
schema_version: "1"
id: b40bf371e992c0ebba3b880099b0b427bc5101a0089d069ac7165c7c327cc0cc
title: Understand the Authentication Status for External Credentials
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/nc_understand_configuration_status.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.nc_understand_configuration_status.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: e70f50a9828bcbf184867712e3ffee531c0526953fac2a0d853d1d4bab3b8a8f
description: The Authentication Status field tells you when you’ve completed all of the required steps to configure an external credential. If your external credential shows a Not Configured status, there’s more work to do before you can use your external credential to make authenticated callouts with a named credential. Learn how to reach a Configured status for each authentication protocol.
products:
  - Security
release: "264"
---
# Understand the Authentication Status for External Credentials

The Authentication Status field tells you when you’ve completed all of the required steps to configure an external credential. If your external credential shows a Not Configured status, there’s more work to do before you can use your external credential to make authenticated callouts with a named credential. Learn how to reach a Configured status for each authentication protocol.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: all editions</td></tr></tbody></table>

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_note.png)

Note The Authentication Status field indicates when the external credential is fully configured, but it doesn’t verify that your connection with the external system works correctly.

These fields represent external credentials in metadata and are required for all external credentials, but they’re not included in the runtime callout to the external system.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col style="width:47.84688995215311%">
          <col style="width:52.153110047846894%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d35095e64">Object</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d35095e67">Field</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Object" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e64 ">External Credential</td>

            <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e67 ">
              <ul>
                <li>Label</li>

                <li>Name</li>

                <li>Authentication Protocol</li>

              </ul>
            </td>

          </tr>
          <tr class="">
            <td data-label="Object" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e64 ">External Credential Principal</td>

            <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e67 ">
              <ul>
                <li>Parameter Name</li>

                <li>Sequence Number</li>

              </ul>
            </td>

          </tr>
        </tbody>
      </table>

Use these tables to understand the additional fields to populate and the actions to take to configure external credentials fully.

## AWS Signature Version 4

The AWS Signature Version 4 authentication protocol supports only the Named Principal identity type. A named principal applies the same credential or authentication configuration for an entire org.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col style="width:23.04147465437788%">
          <col style="width:24.193548387096776%">
          <col style="width:23.271889400921662%">
          <col style="width:29.493087557603687%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d35095e144">AWS Signature Version 4 Variant</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d35095e147">External Credential Fields</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d35095e150">External Credential Principal Fields</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d35095e153">Additional Steps</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="AWS Signature Version 4 Variant" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e144 ">Access Key and Secret</td>

            <td data-label="External Credential Fields" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e147 ">
              <ul>
                <li>Service</li>

                <li>Region</li>

              </ul>
            </td>

            <td data-label="External Credential Principal Fields" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e150 ">
              <ul>
                <li>Access Key</li>

                <li>Secret</li>

              </ul>
            </td>

            <td data-label="Additional Steps" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e153 ">—</td>

          </tr>
          <tr class="">
            <td data-label="AWS Signature Version 4 Variant" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e144 ">STS</td>

            <td data-label="External Credential Fields" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e147 ">
              <ul>
                <li>Service</li>

                <li>Region</li>

                <li>Obtain Temporary IAM Credentials via STS</li>

                <li>STS Access Key</li>

                <li>STS Secret</li>

              </ul>
            </td>

            <td data-label="External Credential Principal Fields" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e150 ">IAM Role ARN</td>

            <td data-label="Additional Steps" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e153 ">—</td>

          </tr>
          <tr class="">
            <td data-label="AWS Signature Version 4 Variant" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e144 ">IAM Roles Anywhere</td>

            <td data-label="External Credential Fields" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e147 ">
              <ul>
                <li>Service</li>

                <li>Region</li>

                <li>Obtain Temporary IAM Credentials via STS</li>

                <li>Trust Anchor ARN</li>

                <li>Profile ARN</li>

                <li>Signing Certificate</li>

              </ul>
            </td>

            <td data-label="External Credential Principal Fields" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e150 ">IAM Role ARN</td>

            <td data-label="Additional Steps" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e153 ">—</td>

          </tr>
        </tbody>
      </table>

## Basic Authentication

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col style="width:23.04147465437788%">
          <col style="width:24.193548387096776%">
          <col style="width:23.271889400921662%">
          <col style="width:29.493087557603687%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d35095e289">Identity Type</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d35095e292">External Credential Fields</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d35095e295">External Credential Principal Fields</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d35095e298">Additional Steps</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Identity Type" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e289 ">Named Principal</td>

            <td data-label="External Credential Fields" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e292 ">—</td>

            <td data-label="External Credential Principal Fields" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e295 ">
              <ul>
                <li>Identity Type</li>

                <li>Username</li>

                <li>Password</li>

              </ul>
            </td>

            <td data-label="Additional Steps" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e298 ">—</td>

          </tr>
          <tr class="">
            <td data-label="Identity Type" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e289 ">Per User Principal</td>

            <td data-label="External Credential Fields" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e292 ">—</td>

            <td data-label="External Credential Principal Fields" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e295 ">Identity Type</td>

            <td data-label="Additional Steps" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e298 ">
              <p>Enable the external credential principal on a permission set or user
                profile.</p>
              <p style="margin-bottom:0;">Then, at least one user must authenticate to the external system from
                the External Credentials page in their personal settings.</p>
            </td>

          </tr>
        </tbody>
      </table>

## Custom Authentication

The Custom authentication protocol supports only the Named Principal identity type. A named principal applies the same credential or authentication configuration for an entire org.

When you create a principal on an external credential that uses the Custom authentication protocol, the authentication status is always Unknown. Because an admin defines the Custom authentication protocol, Salesforce can’t verify when external credentials that use this protocol are configured fully.

## JWT

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col style="width:23.04147465437788%">
          <col style="width:24.193548387096776%">
          <col style="width:23.271889400921662%">
          <col style="width:29.493087557603687%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d35095e388">Identity Type</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d35095e391">External Credential Fields</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d35095e394">External Credential Principal Fields</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d35095e397">Additional Steps</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Identity Type" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e388 ">Named Principal</td>

            <td data-label="External Credential Fields" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e391 ">
              <ul>
                <li>Signing Certificate</li>

                <li>Signing Algorithm</li>

              </ul>
            </td>

            <td data-label="External Credential Principal Fields" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e394 ">Identity Type</td>

            <td data-label="Additional Steps" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e397 ">Review the JWT body claims that Salesforce created when you saved the external
              credential. You can modify some default claims or create your own custom
              claims.</td>

          </tr>
          <tr class="">
            <td data-label="Identity Type" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e388 ">Per User Principal</td>

            <td data-label="External Credential Fields" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e391 ">
              <ul>
                <li>Signing Certificate</li>

                <li>Signing Algorithm</li>

              </ul>
            </td>

            <td data-label="External Credential Principal Fields" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e394 ">Identity Type</td>

            <td data-label="Additional Steps" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e397 ">
              <p>Review the JWT body claims that Salesforce created when you saved the external
                credential. You can modify some default claims or create your own custom
                claims.</p>
              <p style="margin-bottom:0;">Then, enable the external credential principal on a permission set or
                user profile. Assign that permission set or profile to at least one
                user.</p>
            </td>

          </tr>
        </tbody>
      </table>

## No Authentication

The No Authentication protocol supports only the Named Principal identity type. A named principal applies the same credential or authentication configuration for an entire org.

If your external credential uses the No Authentication protocol, no additional fields are required on the external credential or its principal. External credentials have a Configured authentication status as soon as you create and save the principal.

## OAuth 2.0

In addition to the fields required for all external credentials, external credentials that use an OAuth 2.0 authentication protocol also require the Authentication Flow Type field. The other fields that are required to fully configure an OAuth 2.0 external credential depend on the OAuth variant and the identity type of the external credential’s principal.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col style="width:18.726591760299627%">
          <col style="width:18.726591760299627%">
          <col style="width:19.662921348314608%">
          <col style="width:18.913857677902623%">
          <col style="width:23.970037453183522%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d35095e498">OAuth 2.0 Variant</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d35095e501">Identity Type</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d35095e504">External Credential Fields</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d35095e507">External Credential Principal Fields</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d35095e510">Additional Steps</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="OAuth 2.0 Variant" class="slds-cell-wrap" rowspan="2" style="vertical-align:top;" headers="d35095e498 ">Browser Flow</td>

            <td data-label="Identity Type" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e501 ">Named Principal</td>

            <td data-label="External Credential Fields" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e504 ">Authentication Provider</td>

            <td data-label="External Credential Principal Fields" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e507 ">Identity Type</td>

            <td data-label="Additional Steps" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e510 ">Authenticate to the external system on behalf of all users in your Salesforce
              organization. On the External Credential page, select
              <strong class="uicontrol">Authenticate</strong> from the principal’s Actions menu. Then,
              authenticate to the system.
            </td>

          </tr>
          <tr class="">
            <td data-label="Identity Type" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e501 ">Per User Principal</td>

            <td data-label="External Credential Fields" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e504 ">Authentication Provider</td>

            <td data-label="External Credential Principal Fields" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e507 ">Identity Type</td>

            <td data-label="Additional Steps" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e510 ">
              <p>Enable the external credential principal on a permission set or user
                profile.</p>
              <p style="margin-bottom:0;">Then, at least one user must authenticate to the external system from
                the External Credentials page in their personal settings.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="OAuth 2.0 Variant" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e498 ">Client Credentials with Client Secret Flow</td>

            <td data-label="Identity Type" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e501 ">Named Principal</td>

            <td data-label="External Credential Fields" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e504 ">Identity Provider URL</td>

            <td data-label="External Credential Principal Fields" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e507 ">
              <ul>
                <li>Client ID</li>

                <li>Client Secret</li>

              </ul>
            </td>

            <td data-label="Additional Steps" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e510 ">—</td>

          </tr>
          <tr class="">
            <td data-label="OAuth 2.0 Variant" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e498 ">Client Credentials with JWT Assertion Flow</td>

            <td data-label="Identity Type" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e501 ">Named Principal</td>

            <td data-label="External Credential Fields" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e504 ">
              <ul>
                <li>Identity Provider URL</li>

                <li>Signing Certificate</li>

                <li>Signing Algorithm</li>

              </ul>
            </td>

            <td data-label="External Credential Principal Fields" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e507 ">Client ID</td>

            <td data-label="Additional Steps" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e510 ">Review the JWT body claims that Salesforce created when you saved the external
              credential. You can modify some default claims or create your own custom
              claims.</td>

          </tr>
          <tr class="">
            <td data-label="OAuth 2.0 Variant" class="slds-cell-wrap" rowspan="2" style="vertical-align:top;" headers="d35095e498 ">JWT Bearer Flow</td>

            <td data-label="Identity Type" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e501 ">Named Principal</td>

            <td data-label="External Credential Fields" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e504 ">
              <ul>
                <li>Identity Provider URL</li>

                <li>Signing Certificate</li>

                <li>Signing Algorithm</li>

              </ul>
            </td>

            <td data-label="External Credential Principal Fields" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e507 ">Identity Type</td>

            <td data-label="Additional Steps" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e510 ">Review the JWT body claims that Salesforce created when you saved the external
              credential. You can modify some default claims or create your own custom
              claims.</td>

          </tr>
          <tr class="">
            <td data-label="Identity Type" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e501 ">Per User Principal</td>

            <td data-label="External Credential Fields" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e504 ">
              <ul>
                <li>Identity Provider URL</li>

                <li>Signing Certificate</li>

                <li>Signing Algorithm</li>

              </ul>
            </td>

            <td data-label="External Credential Principal Fields" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e507 ">Identity Type</td>

            <td data-label="Additional Steps" class="slds-cell-wrap" style="vertical-align:top;" headers="d35095e510 ">
              <p>Review the JWT body claims that Salesforce created when you saved the external
                credential. You can modify some default claims or create your own custom
                claims.</p>
              <p style="margin-bottom:0;">Then, enable the external credential principal on a permission set or
                user profile. Assign that permission set or profile to at least one
                user.</p>
            </td>

          </tr>
        </tbody>
      </table>

#### See Also

- [Named Credentials](https://help.salesforce.com/s/articleView?id=xcloud.named_credentials_about.htm&release=264.0.0&type=5 "Intended to secure and simplify authenticated API callouts to external systems, a named credential specifies the URL of a callout endpoint and its required authentication parameters in one definition. To streamline your Apex code and simplify the setup of authenticated callouts, specify a named credential as the callout endpoint.")
- [Create Named Credentials and External Credentials](https://help.salesforce.com/s/articleView?id=xcloud.nc_named_creds_and_ext_creds.htm&release=264.0.0&type=5 "To simplify the setup of authenticated callouts, create an external credential to specify an authentication protocol and then specify a named credential as the callout endpoint. Add custom headers to cover more use cases and security requirements. Use a permission set or profile to grant access so that users can make authenticated callouts. You can create and configure named credentials programmatically or through the Salesforce UI.")
- [Troubleshooting for Named Credentials](https://help.salesforce.com/s/articleView?id=xcloud.nc_troubleshoot.htm&release=264.0.0&type=5 "Review the potential causes and troubleshooting steps for common issues that you can encounter when you set up or use named credentials.")