---
schema_version: "1"
id: 7eec163c87994098eceb2d0772fbce3102959c8e0598ec612ca3b75cbd611de0
title: Integrate an App for the Token Exchange Flow
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/remoteaccess_token_exchange_integrate.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_token_exchange_integrate.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 764410ba138e13baa3c2537ad95fee6e1990cec8b8a3f98c9d9277da081de117
description: To integrate an app with Salesforce for the OAuth 2.0 token exchange flow, create a Salesforce connected app or an external client app.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Integrate an App for the Token Exchange Flow

To integrate an app with Salesforce for the OAuth 2.0 token exchange flow, create a Salesforce connected app or an external client app.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong> Editions</td></tr></tbody></table>

- **[Option 1: Create a Connected App](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_token_exchange_integrate.htm&release=264.0.0&type=5)**  
    To enable a connected app for the token exchange flow, take these steps.
- **[Option 2: Create an External Client App](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_token_exchange_integrate.htm&release=264.0.0&type=5)**  
    To enable an external client app for the token exchange flow, take these steps.

## Option 1: Create a Connected App

To enable a connected app for the token exchange flow, take these steps.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
            <colgroup>
              <col style="width:50%">
              <col style="width:50%">
            </colgroup>
            <thead class="slds-text-title_caps ">
              <tr class="">
                <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d71586e109">User Permissions Needed</th>
              </tr>
            </thead>
            <tbody>
              <tr class="">
                <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d71586e109 ">To read, create, update, or delete connected apps:</td>
                <td class="slds-cell-wrap" style="vertical-align:top;" headers="d71586e109 ">
                  <p>Customize Application AND either</p>
                  <p style="margin-bottom:0;">Modify All Data OR Manage Connected
                    Apps</p>
                </td>
              </tr>
              <tr class="">
                <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d71586e109 ">To update all fields except Profiles, Permission Sets, and Service Provider SAML
                  Attributes:</td>
                <td class="slds-cell-wrap" style="vertical-align:top;" headers="d71586e109 ">
                  <p>Customize Application AND either</p>
                  <p style="margin-bottom:0;">Modify All Data OR Manage Connected
                    Apps</p>
                </td>
              </tr>
              <tr class="">
                <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d71586e109 ">To update Profiles, Permission Sets, and Service Provider SAML Attributes:</td>
                <td class="slds-cell-wrap" style="vertical-align:top;" headers="d71586e109 ">Customize Application AND Modify All Data AND Manage Profiles and Permission
                  Sets</td>
              </tr>
              <tr class="">
                <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d71586e109 ">To rotate the consumer key and consumer secret:</td>
                <td class="slds-cell-wrap" style="vertical-align:top;" headers="d71586e109 ">Allow consumer key and secret rotation</td>
              </tr>
              <tr class="">
                <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d71586e109 ">To install and uninstall connected apps:</td>
                <td class="slds-cell-wrap" style="vertical-align:top;" headers="d71586e109 ">
                  <p>Customize Application AND either</p>
                  <p style="margin-bottom:0;">Modify All Data OR Manage Connected
                    Apps</p>
                </td>
              </tr>
              <tr class="">
                <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d71586e109 ">To install and uninstall packaged connected apps:</td>
                <td class="slds-cell-wrap" style="vertical-align:top;" headers="d71586e109 ">
                  <p>Download AppExchange Packages AND Customize Application AND either</p>
                  <p style="margin-bottom:0;">Modify All Data
                    OR Manage Connected Apps</p>
                </td>
              </tr>
            </tbody>
          </table>

1. Create a connected app and [complete its basic information](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create_basics.htm&type=5&language=en_US).
2. [Enable the connected app’s OAuth settings for API integration](https://help.salesforce.com/s/articleView?language=en_US&id=sf.connected_app_create_api_integration.htm). In addition to enabling OAuth and entering a callback URL, use these settings.
    1. To define the app’s permissions, select scopes. When you configure the flow, the token request can optionally include a `scopes` parameter. The scopes in this parameter must match or be a subset of the scopes assigned to the connected app.
    2. Select **Enable Token Exchange Flow**.
    3. Optionally, select **Require Secret for Token Exchange Flow**. We recommend that you enable this setting only for private clients with a secure client back end. For public clients that can’t keep the consumer secret confidential, such as single-page apps and mobile apps, don’t enable this setting.
    4. Optionally, to issue JSON Web Token (JWT)-based access tokens instead of opaque access tokens, see [Enable JSON Web Token (JWT)-Based Access Tokens](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_enable_jwt.htm&type=5&language=en_US).
3. [Set the OAuth policies for the connected app](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_oauth.htm&type=5&language=en_US). Make sure you use these settings.
    1. For the Permitted Users policy, select **Admin approved users are pre-authorized**. To control which users are admin approved, [manage which profiles are assigned to the app](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_additional_settings.htm&type=5&language=en_US).
    2. Select **Enable Token Exchange Flow**.
4. Save your changes.

Next, create a token exchange handler Apex class.

## Option 2: Create an External Client App

To enable an external client app for the token exchange flow, take these steps.

Before you start, [set up permissions for external client apps](https://help.salesforce.com/s/articleView?id=xcloud.custom_scopes_for_external_client_apps.htm&type=5&language=en_US).

1. [Create a local external client app](https://help.salesforce.com/s/articleView?id=xcloud.create_a_local_external_client_app.htm&type=5&language=en_US) and configure its basic settings.
2. [Deploy the external client app](https://help.salesforce.com/s/articleView?id=xcloud.deploy_external_client_app.htm&type=5&language=en_US).
3. [Configure the external client app global OAuth settings](https://help.salesforce.com/s/articleView?language=en_US&id=sf.configure_external_client_app_global_oauth_settings.htm). Make sure you set these fields.
    
    | Field | Description |
    | --- | --- |
    | isTokenExchangeEnabled | Boolean field indicating whether the token exchange flow is enabled. Set this field to `true`. |
    | isSecretRequiredForTokenExchange | Boolean field indicating whether the app is required to send its consumer secret in the token request. We recommend that you set this field to `true` only if your app has a private client back end that can keep the secret confidential. For public clients such as mobile apps and single-page apps, set this field to `false`. |
    
    Here’s an example global OAuth settings file.
    
    ```markup
    <?xml version="1.0" encoding="UTF-8"?>
    <ExtlClntAppGlobalOauthSettings xmlns="http://soap.sforce.com/2006/04/metadata">
        <callbackUrl>https://www.example.com</callbackUrl>
        <externalClientApplication>myeca</externalClientApplication>
        <idTokenConfig>
            <idTokenAudience>SalesforceAudience</idTokenAudience>
            <idTokenIncludeStandardClaims>true</idTokenIncludeStandardClaims>
            <idTokenValidityInMinutes>0</idTokenValidityInMinutes>
        </idTokenConfig>
        <isConsumerSecretOptional>false</isConsumerSecretOptional>
        <isIntrospectAllTokens>false</isIntrospectAllTokens>
        <isPkceRequired>false</isPkceRequired>
        <isSecretRequiredForRefreshToken>false</isSecretRequiredForRefreshToken>
        <label>myecaglobalset</label>
        <shouldRotateConsumerKey>false</shouldRotateConsumerKey>
        <shouldRotateConsumerSecret>false</shouldRotateConsumerSecret>
        <isTokenExchangeEnabled>true</isTokenExchangeEnabled>
        <isSecretRequiredForTokenExchange>true</isSecretRequiredForTokenExchange>
    </ExtlClntAppGlobalOauthSettings>
    ```
4. [Configure the external client app OAuth settings](https://help.salesforce.com/s/articleView?id=xcloud.configure_external_client_app_oauth_settings.htm&type=5&language=en_US), which affect the local instance. In addition to the required fields, optionally use the commaSeparatedOauthScopes field to specify scopes. If you send a `scopes` parameter in your token request, the scopes must match or be a subset of the scopes assigned to your external client app.
5. [Configure the external client app OAuth policies](https://help.salesforce.com/s/articleView?id=xcloud.external_client_app_oauth_policies_configuration.htm&type=5&language=en_US). If you create your own policies file, make sure that the `permittedUsersPolicyType` field is set to `AdminApprovedPreAuthorized`.
6. [Deploy the external client app OAuth plugin](https://help.salesforce.com/s/articleView?id=xcloud.deploy_external_client_app_oauth_plugin.htm&type=5&language=en_US).

Next, create a token exchange handler Apex class.