---
schema_version: "1"
id: 367dc520e33675d378623b4aaf51d76ceaf640a676c6b69dd86c4f4e7a52ee5f
title: Create an OAuth Custom Scope
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/remoteaccess_oauth_customscopes_create.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_customscopes_create.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: b2f0ff7e52dbe9078baf96ceccad7361b242dfc5d3c6df3ad834b82f965d6b03
description: To define permissions about the data that an external client app can access from an external entity, create an OAuth custom scope in Salesforce. The custom scope tells the external entity which information the external client app is authorized to access.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Create an OAuth Custom Scope

To define permissions about the data that an external client app can access from an external entity, create an OAuth custom scope in Salesforce. The custom scope tells the external entity which information the external client app is authorized to access.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
        <colgroup>
          <col>
        </colgroup>
        <tbody>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and
              Lightning Experience</td>
          </tr>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">
              <p>External client apps can be created in: <strong>Group</strong>, <strong>Essentials</strong>, <strong>Professional</strong>,
                <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong>
                Editions
              </p>
              <p style="margin-bottom:0;">External client apps can be installed in: All editions</p>
            </td>
          </tr>
        </tbody>
      </table> <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d64085e61">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d64085e61 ">To manage, create, edit, and delete OAuth apps:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d64085e61 ">Manage external client apps</td>
          </tr>
        </tbody>
      </table>

The OAuth custom scope that you create in your Salesforce org corresponds to a policy that you define in your external entity and assign to the resource.

For example, you want to create a custom web app that can access customer order status data in your order status API. In Salesforce, you create an order\_status OAuth custom scope. You assign the Salesforce custom scope to the external client app that is requesting access to the order status API. You then define an order\_status policy in your external entity. This policy allows access to customer order status data in your order system’s API. When the external entity receives the external client app’s request to access a customer’s order status, it validates the external client app’s access token and order\_status scope. With a successful validation, the app can access the customer order status information in the order system API.

1. From Setup, enter Custom Scopes in the Quick Find box, and select **OAuth Custom Scopes**.
2. Click **New Custom Scope**.
3. Enter the name of the custom scope. When you define the corresponding policy in your external entity, give it the exact name as the custom scope.
    
    The name of the custom scope must be unique and begin with a letter. Include only alphanumeric characters and underscores. You can’t use spaces in custom scope names.
4. Enter a description of the protected data that the scope allows access to. The description must be unique, include only alphanumeric characters, and not be more than 60 characters.
    
    You can enter a custom label in place of a description. An advantage of custom labels is that you can maintain reusable text in a single location and translate the text into multiple languages. See [Custom Labels](https://help.salesforce.com/articleView?id=cl_about.htm&language=en_US).
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)
    
    Note The same description formatting requirements apply to the custom labels that are associated with custom scopes.
    
    Custom scope descriptions and custom labels display on the OAuth approval page when a user approves the external client app to which the custom scope is assigned.
5. To include the custom scope in the external client app’s OpenID Connect discovery endpoint (`https://<your_domain_name>.my.salesforce.com/.well-known/openid-configuration`), select **Include on well known endpoint**.
    
    ![Custom scopes included in well-know endpoint.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/identity/images/remoteaccess_oauth_customscopes_wellknownendpoint.png)

#### See Also

- [Query for the OpenID Connect Configuration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_using_openid_discovery_endpoint.htm&release=264.0.0&type=5 "Use the OpenID Connect discovery endpoint to query for information about the Salesforce OpenID Connect configuration. Salesforce returns basic information about endpoints, supported scopes, and other values used for OpenID Connect authorization.")