---
schema_version: "1"
id: 3a542896fd8a430128538df6616acea1eccfb21c13b07f85ab197dd92b505070
title: "OAuth 2.0 for First-Party Applications: Configure an External Client App for Headless Identity Flows"
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/remoteaccess_eca_auth_challenge.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_eca_auth_challenge.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 6fa73f17c9f19d9f2b9c569e60f3a1304331a57f5723f01058c82bb66d04ec8e
description: To develop headless identity flows that use the OAuth 2.0 for First-Party Applications draft standard, configure an external client app. For these flows, you must configure your external client app via Metadata API. Use these steps to configure an app for headless username-password login, passwordless login, and registration.
products:
  - Security
  - Cross Cloud
release: "264"
---
# OAuth 2.0 for First-Party Applications: Configure an External Client App for Headless Identity Flows

To develop headless identity flows that use the OAuth 2.0 for First-Party Applications draft standard, configure an external client app. For these flows, you must configure your external client app via Metadata API. Use these steps to configure an app for headless username-password login, passwordless login, and registration.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Enterprise</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong> Editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d3761e46">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d3761e46 ">To configure both settings and policies as an external client app developer:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d3761e46 ">Create, edit, and delete External Client Apps</td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d3761e46 ">To manage external client app policies as an external client app admin:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d3761e46 ">View all External Client Apps, view their settings, and edit their policies</td>
          </tr>
        </tbody>
      </table>

The OAuth plugin must also be enabled for your external client app. For more information, see these resources.

- [Create a Local External Client App](https://help.salesforce.com/s/articleView?id=xcloud.create_a_local_external_client_app.htm&type=5&language=en_US)
- [Enable or Disable External Client App Plugins](https://help.salesforce.com/s/articleView?id=sf.enable_external_client_app_plugins.htm&language=en_US)
- [OAuth Plugin Enablement](https://help.salesforce.com/s/articleView?id=xcloud.enable_oauth_plugin.htm&type=5&language=en_US)
- [Configure Packageable External Client Apps](https://help.salesforce.com/s/articleView?id=xcloud.configure_packageable_external_client_apps.htm&type=5&language=en_US)

1. (Developers only) Configure these settings in the external client app’s [global OAuth settings file](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_extlclntappglobaloauthsettings.htm).
    
    1. Set the isConsumerSecretOptional field to `false`. These flows are supported only for private clients, which can keep the consumer secret secure in a private client backend.
    2. Set isPkceRequired to `true`. If you don't use PKCE, the security features of this flow don't work properly.
    3. Deploy the changes.
    
    For more information, see [Configure the External Client App Global OAuth Settings](https://help.salesforce.com/s/articleView?id=sf.configure_external_client_app_global_oauth_settings.htm&language=en_US).
2. (Developers only) Configure these settings in the external client app's [OAuth settings file](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_extlclntappoauthsettings.htm).
    
    1. Set the isFirstPartyAppsEnabled setting to `true`.
    2. For clientAssertionCertificate, register the certificate that you're using to sign the client attestation JWT.
    
    For more information, see [Configure the External Client App OAuth Settings](https://help.salesforce.com/s/articleView?id=xcloud.configure_external_client_app_oauth_settings.htm&type=5&language=en_US).
3. Modify the app’s [configurable OAuth policies](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_extlclntappoauthconfigurablepolicies.htm).
    
    1. Set the value for permittedUsersPolicyType to `AdminApprovedPreAuthorized`.
        
        ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)
        
        Note Saving this change causes all users currently using the app to lose access.
    2. To define which users are admin-approved, use [permission sets](https://help.salesforce.com/s/articleView?id=platform.perm_sets_overview.htm&type=5&language=en_US). Enter a list of permission set IDs for the commaSeparatedPermissionSet field.
    
    Your app can now use the OAuth 2.0 for First-Party Applications flows for headless username-password login, passwordless login, and registration.