---
schema_version: "1"
id: 6f4d53e77c9e0f6eb4340cf2a955b54acadac9c85bbe70a6bbb82bd1f1e03dfe
title: Create an OAuth-Enabled External Client App
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/security/headless-identity-impl-guide/guides/headless-identity/headless-identity-create-connected-app.md
canonical_url: https://developer.salesforce.com/docs/platform/headless-identity-impl-guide/guide/headless-identity-create-connected-app.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 1034401a77f43bf4a40985c29106010a173f1512f57cd61d126d4aa2baac0a1d
products:
  - Headless Identity Implementation Guide
  - Security
---

# Create an OAuth-Enabled External Client App

Create your external client app for headless identity, add the required scopes, and enable the Authorization Code and Credentials flow at the app level.

|Required Editions|
|-----------------|
|Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience|
|Available in: **Enterprise**, **Unlimited**, and **Developer** Editions|

1.  [Create an external client app](https://www.passkeycentral.org/introduction-to-passkeys/passkey-security) and set the distribution state to Local.

2.  Under API (Enable OAuth Settings), select **Enable OAuth Settings**.

3.  For Callback URL, enter `https://MyExperienceCloudSite.my.site.com/services/oauth2/echo`, where `https://MyExperienceCloudSite.my.site.com` is your Experience Cloud site domain.

    This URL points to the Salesforce OAuth 2.0 echo endpoint on your Experience Cloud site. The echo endpoint handles the code extraction step for headless login and headless registration, which saves you the work of writing and hosting your own code extraction endpoint. It returns the authorization code and other parameters from the 302 redirect as a JSON object that you can easily parse.

4.  For Selected OAuth Scopes, add the **Manage user data via APIs (api)** and **Access unique user identifiers (openid)** scopes

5.  For security, deselect these settings.


    -   **Require Secret for Web Server Flow**
    -   **Require Secret for Refresh Token Flow**
    Because this example is focused on single-page apps, which can’t keep information private, you don't want to send the app's consumer secret in HTTP requests.

6.  Select **Enable Code and Credential Flow**.

    Enabling the flow exposes another setting to require user credentials in the POST body of your authorization request. Leave this setting deselected—again, your app can’t keep this information secret.

7.  Save your external client app settings.


Now that you have an OAuth-enabled external client app, you can get your consumer key and consumer secret.