---
schema_version: "1"
id: f3c31df12ae9187b96cf91a043a703476c265845c56acfb177b25c2395929a42
title: "Step 1: Create an External Client App and Configure Policies"
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/service-cloud/messaging-byob/guides/create-external-client-app.md
canonical_url: https://developer.salesforce.com/docs/service/messaging-byob/guide/create-external-client-app.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: f659ce494d81e4e85a4b1e3ba559fcbaa8cdefc03609b0c79611b203767574b4
products:
  - Bring Your Own Bot for Messaging
  - Service Cloud Developer Content
---
# Step 1: Create an External Client App and Configure Policies

Make sure you have the public key file saved on your system. When you create the ExternalClientApp, you'll require the file to upload. If you don't have a self-signed certificate, follow the steps to [Create a Private Key and Self-Signed Digital Certificate](https://developer.salesforce.com/docs/atlas.en-us.210.0.sfdx_dev.meta/sfdx_dev/sfdx_dev_auth_key_and_cert.htm).

1. From Setup, in the Quick Find box, enter `External Client Apps`.
2. Click **External Client App** and then click **New External Client App**.
3. Under Basic Information, enter this information.
   - **External Client App Name**: `{prefix} {externalClientAppName}`
   - **API Name**: `{prefix}_{externalClientAppName}`
   - **Contact Email**: [notification email]
   - **Description**: [optional description]
4. Under API (Enable OAuth Settings), click **Enable OAuth**.
5. Add a callback URL (endpoint), which is the same as the OAuth redirect URI. We recommend you use `https://www.salesforce.com/in`.
6. Select these OAuth Scopes:
   - Access Interaction API resources (`interaction_api`)
   - Perform Requests at any time (`refresh_token`, `offline_access`)
7. Click **Enable JWT Bearer Flow** and upload the public certificate. For more information on JWT Bearer Flow and certificates, see [JWT Bearer Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_jwt_flow.htm&type=5).
8. Click **Create**.
9. Click the **Policies** tab and then click **Edit**.
10. Under OAuth Policies, from **Permitted Users** select **Admin approved users are pre-authorized**, and then click **Ok**.
11. Under **Select Profiles**, select the System Administrator profile.
12. Click **Save**.

## Next Steps

After you create the external client app, [generate an access token](https://developer.salesforce.com/docs/service/messaging-byob/guide/generate-access-token.md).