---
schema_version: "1"
id: 906a96d1a1f8d49c59c8f265bdf70bd6fb437cdf5a2b2f884d03b5374651008d
title: Assign an OAuth Custom Scope to an External Client App
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/remoteaccess_oauth_customscopes_assign.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_customscopes_assign.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 91c346e732287f2464207d1c88b567424004aa5815663331e57cac68eb868f6e
description: After you create an OAuth custom scope in your Salesforce org, you can assign it to an external client app to set data-access permissions for the app. For example, an external client app with an order_status custom scope has the correct permission set to access order status data from the external entity.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Assign an OAuth Custom Scope to an External Client App

After you create an OAuth custom scope in your Salesforce org, you can assign it to an external client app to set data-access permissions for the app. For example, an external client app with an order\_status custom scope has the correct permission set to access order status data from the external entity.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
        <colgroup>
          <col>
        </colgroup>
        <tbody>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and
              Lightning Experience</td>
          </tr>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">
              <p>External client apps can be created in: <strong>Group</strong>, <strong>Essentials</strong>, <strong>Professional</strong>,
                <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong>
                Editions
              </p>
              <p style="margin-bottom:0;">External client apps can be installed in: All editions</p>
            </td>
          </tr>
        </tbody>
      </table> <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d12454e61">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d12454e61 ">To manage, create, edit, and delete OAuth apps:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d12454e61 ">Manage external client apps</td>
          </tr>
        </tbody>
      </table>

Typically, to receive custom scopes that are assigned to an external client app, you must include the `scope` parameter in the authorization request. With the OAuth 2.0 JWT bearer flow, for external client apps that are pre-authorized, custom scopes are automatically returned with an access token. For more information, see [OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_jwt_flow.htm&release=264.0.0&type=5 "Sometimes you want to authorize servers to access data without interactively logging in each time the servers exchange information. For these cases, you can use the OAuth 2.0 JSON Web Token (JWT) bearer flow. This flow uses a certificate to sign the JWT request and doesn’t require explicit user interaction. However, this flow does require prior approval of the client app.").

1. From Setup, in the Quick Find box, enter external client apps, and select **External Client Apps Manager**.
2. From the list, select the external client app.
3. Expand the OAuth Policies section of the Policies page.
4. Select the OAuth custom scopes to assign to the external client app, and save your updates.