---
schema_version: "1"
id: d841b3161fbf57ca7f69508ccdb31a97f199807d372f81d58d5751a3d6d3b842
title: Configure External Client App Policies
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/security/headless-identity-impl-guide/guides/headless-identity/headless-identity-connected-app-policies.md
canonical_url: https://developer.salesforce.com/docs/platform/headless-identity-impl-guide/guide/headless-identity-connected-app-policies.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 8bde705c6b10d98b817d4339a025d83c5f7297d1ca97567ae72bb31498372cb8
products:
  - Headless Identity Implementation Guide
  - Security
---

# Configure External Client App Policies

In a standard OAuth flow, users often see an approval page where they confirm that an external client app is allowed to access their Salesforce data. With headless identity flows, you don’t want to show users a Salesforce approval page. To preapprove access, configure OAuth policies on your external client app.

|Required Editions|
|-----------------|
|Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience|
|Available in: **Enterprise**, **Unlimited**, and **Developer** Editions|

1.  Go to your external client app policy page.


    1.  From Setup, in the Quick Find box, enter `App`, and then select **App Manager**.

    2.  Next to your app, click ![External client app edit dropdown arrow](https://developer.salesforce.com/media/headless-identity-impl-guide/connectedappdropdown.png), and then select **Edit Policies**.

2.  Click **Edit Policies**.

3.  Under OAuth Policies, set the Permitted Users policy to **Admin approved users are pre-authorized**.

4.  Save the policy change.

5.  On the external client app policy page, scroll down to and select **Manage Profiles**.

6.  Select the headless demo profile that you created.

7.  Save the policy change.