--- schema_version: "1" id: 5823266eb3d8446a861ecef7cd7db98fd18e5bcbdaf990d958a97b05a392bc96 title: Permission Concepts for User External Credentials collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/nc_user_external_credentials_permissions.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.nc_user_external_credentials_permissions.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: a258a2ab453e1086ed944696306ea8e48a4049256d4cefb7022d3fffb285ac48 description: As a Salesforce admin, you must pay careful attention to security and permissions settings in your org. We recommend that you limit data access to the lowest level possible, while still allowing everyone to do their jobs. This strategy is known as the principle of least privilege. Whether you enable user external credentials via permission sets or profiles, follow this guidance to grant the appropriate access for each authentication protocol. products: - Security release: "264" --- # Permission Concepts for User External Credentials As a Salesforce admin, you must pay careful attention to security and permissions settings in your org. We recommend that you limit data access to the lowest level possible, while still allowing everyone to do their jobs. This strategy is known as the principle of least privilege. Whether you enable user external credentials via permission sets or profiles, follow this guidance to grant the appropriate access for each authentication protocol. ### Required Editions
Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience
Available in: all editions
User external credential objects store encrypted tokens used by named credentials to authenticate to external systems. In order to perform an authenticated callout, users need profile- or permission set-based access to user external credentials. These tables outline the necessary permissions for each authentication protocol. For more information about the authentication protocols, see [Authentication Protocols for Named Credentials](https://help.salesforce.com/s/articleView?id=xcloud.nc_auth_protocols.htm&release=264.0.0&type=5 "Your connections between Salesforce and external systems use an authentication protocol to confirm secure communication between the two systems. Choose the authentication protocol that matches the configuration of the external system that you connect to. When you do, keep the strengths and considerations of each authentication protocol in mind."). ## OAuth 2.0
OAuth 2.0 Variant Identity Type Role Access Level Reason
  • Browser Flow
  • JWT Bearer Flow
  • Client Credentials with JWT Assertion Flow
  • Client Credentials with Client Secret Flow
 Named Principal Users making callouts Modify All Records

Users can make a callout using the access tokens entered by the admin.

If a callout uses expired access tokens, the Modify All permission grants Salesforce access to retrieve refreshed tokens from the external system and update the external credential’s principal with the new tokens on behalf of the user making the callout. Users can’t access or update the named credential configuration in Setup.
  • Browser Flow
  • JWT Bearer Flow
 Per User Principal Users making callouts Read, Create, Edit, Delete Each user can enter their credentials to authenticate to the external system, make callouts using the named credential, and revoke access, if needed.
## AWS Signature Version 4
AWS Signature Version 4 Variant Identity Type Role Access Level Reason
Access Key and Secret Named Principal Salesforce admin Read, Create, Edit, Delete Only the admin can enter the access key and secret to authenticate to the external system or revoke access.
Users making callouts View All Records

Users can make a callout using the access key and secret entered by the admin.

View All permission grants Salesforce access to the credentials for the external system on behalf of the user making a callout. Users can’t access the named credential configuration in Setup.
  • STS
  • IAM Roles Anywhere
 — Users making callouts Modify All Records

Users can make a callout using the access tokens entered by the admin.

If a callout uses expired access tokens, the Modify All permission grants Salesforce access to retrieve refreshed tokens from the external system and update the external credential’s principal with the new tokens on behalf of the user making the callout. Users can’t access or update the named credential configuration in Setup.
## Custom Authentication The Custom authentication protocol supports only the Named Principal identity type. A named principal applies the same credential or authentication configuration for an entire org.
Role Access Level Reason
Salesforce admin Read, Create, Edit, Delete Only the admin can enter access tokens or API keys to authenticate to the external system or revoke access.
Users making callouts View All Records

Users can make a callout using the access tokens entered by the admin.

The View All permission grants Salesforce access to the credentials for the external system on behalf of the user making a callout. Users can’t access the named credential configuration in Setup.
## Basic Authentication
Identity Type Role Access Level Reason
Named Principal Salesforce admin Read, Create, Edit, Delete Only the admin can enter credentials to authenticate to the external system or revoke access.
Users making callouts View All Records

Users can make a callout using the credentials entered by the admin.

The View All permission grants Salesforce access to the credentials for the external system on behalf of the user making a callout. Users can’t access the named credential configuration in Setup.
Per User Principal Users making callouts Read, Create, Edit, Delete Each user can enter their credentials to authenticate to the external system, make callouts using the named credential, and revoke access, if needed.
## JWT | Identity Type | Role | Access Level | Reason | | --- | --- | --- | --- | | Named Principal | Users making callouts | Read | The Read permission grants users access to additional authentication parameters so that they can make callouts using the named credential. | | Per User Principal | Users making callouts | Read | The Read permission grants users access to additional authentication parameters so that they can make callouts using the named credential. | ## No Authentication The No Authentication protocol supports only the Named Principal identity type. A named principal applies the same credential or authentication configuration for an entire org. | Role | Access Level | Reason | | --- | --- | --- | | Users making callouts | Read | The Read permission grants users access to additional authentication parameters so that they can make callouts using the named credential. | #### See Also - [Create Named Credentials and External Credentials](https://help.salesforce.com/s/articleView?id=xcloud.nc_named_creds_and_ext_creds.htm&release=264.0.0&type=5 "To simplify the setup of authenticated callouts, create an external credential to specify an authentication protocol and then specify a named credential as the callout endpoint. Add custom headers to cover more use cases and security requirements. Use a permission set or profile to grant access so that users can make authenticated callouts. You can create and configure named credentials programmatically or through the Salesforce UI.") - [Enable User External Credentials](https://help.salesforce.com/s/articleView?id=xcloud.nc_user_external_credentials.htm&release=264.0.0&type=5 "Tokens for named credential callouts are encrypted and stored in the User External Credential object. Any user performing an authenticated callout needs profile- or permission set-based access to user external credentials. Most standard permission sets and profiles have access to the User External Credentials object by default. For the guest user profile, and for some custom permission sets and profiles, you must assign User External Credentials object permissions manually.")