---
schema_version: "1"
id: 9cf18e57cb88f4c3df72bc0265302142420fb17e760735f0611b9638822dc274
title: OAuth 2.0 Token Exchange Flow
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/remoteaccess_token_exchange_overview.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_token_exchange_overview.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 58ef4c938d211c4baa9e068a487de144d19a43ebb90bc287e8e7cdbc5211b256
description: When Salesforce is just one component of an architecture that includes a central identity provider along with multiple apps and microservices, use the OAuth 2.0 token exchange flow to simplify your integration patterns. With this flow, exchange tokens from external identity providers for Salesforce tokens and grant access to Salesforce data.
products:
  - Security
  - Cross Cloud
release: "264"
---
# OAuth 2.0 Token Exchange Flow

When Salesforce is just one component of an architecture that includes a central identity provider along with multiple apps and microservices, use the OAuth 2.0 token exchange flow to simplify your integration patterns. With this flow, exchange tokens from external identity providers for Salesforce tokens and grant access to Salesforce data.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong> Editions</td></tr></tbody></table>

To learn more about how this flow works and how to set it up, see these resources.

- **[Token Exchange Flow Use Cases](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_token_exchange_use_cases.htm&release=264.0.0&type=5)**  
    To decide if the OAuth 2.0 token exchange flow is the right solution for your company, learn more about when to use it.
- **[Token Exchange Flow Diagram and Process](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_token_exchange_diagram.htm&release=264.0.0&type=5)**  
    The OAuth 2.0 token exchange flow can simplify integrations for use cases with a central identity provider serving multiple apps and microservices. To understand how the flow works, review this step-by-step overview.
- **[Integrate an App for the Token Exchange Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_token_exchange_integrate.htm&release=264.0.0&type=5)**  
    To integrate an app with Salesforce for the OAuth 2.0 token exchange flow, create a Salesforce connected app or an external client app.
- **[Create a Token Exchange Handler Apex Class](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_token_exchange_create_apex.htm&release=264.0.0&type=5)**  
    A token exchange handler consists of an Apex class that extends the `Oauth2TokenExchangeHandler` abstract class and a token exchange handler definition. To get started, create an Apex class to reference in the handler definition.
- **[Define a Token Exchange Handler](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_token_exchange_handler_define.htm&release=264.0.0&type=5)**  
    To finish creating a token exchange handler, define the handler on the Token Exchange Handlers page in Setup, or use Metadata API to define a new OauthTokenExchangeHandler metadata type.
- **[Enable Apps for a Token Exchange Handler](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_token_exchange_enable.htm&release=264.0.0&type=5)**  
    To enable a connected app or external client app for a token exchange handler, use the Token Exchange Handlers page in Setup, or edit its metadata definition.
- **[Set Up the Token Exchange Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_token_exchange_configure.htm&release=264.0.0&type=5)**  
    Some use cases require you to integrate Salesforce with an external identity provider along with multiple apps and microservices. To simplify these integrations, use the OAuth 2.0 token exchange flow. With this flow, exchange tokens from an external identity provider for Salesforce tokens.
- **[Edit or Delete a Token Exchange Handler](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_token_exchange_edit_remove.htm&release=264.0.0&type=5)**  
    If necessary, edit a token exchange handler's settings or delete it entirely.