---
schema_version: "1"
id: d50ca1ac03650788583f8f73a69b00922fc4fb5b7789d431a11522d4ab144566
title: ExternalClientAppSettings
collection: legacydeveloper
version: current
locale: en-us
portal_url: https://docs.salesforce.com/legacydeveloper/current/en-us/api_meta/meta_externalclientappsettings.md
canonical_url: https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_externalclientappsettings.htm
source_site: developer.salesforce.com
content_type: documentation
content_hash: 4d30c1e86b37fc807caa6ce9162ed6de2eaef3847cf1b51b2bd2e013d92d776f
description: Represents settings to enable external client app features.
---
# ExternalClientAppSettings

Represents settings to enable external client app features.

## Parent Type and Manifest Access

This type extends the [Metadata](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/metadata.htm "The base class for all metadata types. You can’t edit this object. A component is an instance of a metadata type.") metadata type and inherits its fullName field.

In the package manifest, all the settings metadata types are accessed using the Settings name. See [Settings](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_settings.htm "Represents the organization settings related to a feature. For example, your password policies, session settings and network access controls are all available in the SecuritySettings component type.") for more details.

## File Suffix and Directory Location

ExternalClientAppSettings values are stored in the .settings file in the settings folder. The .settings files are different from other named components, because there’s only one settings file for each settings component.

## Version

ExternalClientAppSettings components are available in API version 58.0 and later.

## Fields

<table class="featureTable sort_table" summary="">



          <thead class="thead sorted" align="left">
            <tr>
              <th class="featureTableHeader  " id="d472102e117">Field Name</th>

              <th class="featureTableHeader  " id="d472102e120">Field Type</th>

              <th class="featureTableHeader  " id="d472102e123">Description</th>

            </tr>

          </thead>

          <tbody class="tbody">
            <tr>
              <td class="entry" headers="d472102e117" data-title="Field Name"><span class="keyword parmname">enableClientSecretInRestApiAccess</span></td>

              <td class="entry" headers="d472102e120" data-title="Field Type">boolean</td>

              <td class="entry" headers="d472102e123" data-title="Description">Indicates whether OAuth consumer secrets can be accessed through the
                <span class="keyword parmname">credentials</span> REST API (<samp class="codeph nolang">true</samp>) or not (<samp class="codeph nolang">false</samp>). This field is
                available in API version 62.0 and later.
              </td>

            </tr>

            <tr>
              <td class="entry" headers="d472102e117" data-title="Field Name"><span class="keyword parmname">enableConsumerSecretApiAccess</span></td>

              <td class="entry" headers="d472102e120" data-title="Field Type">boolean</td>

              <td class="entry" headers="d472102e123" data-title="Description">DEPRECATED. Indicates whether OAuth consumer secrets can be accessed through
                Metadata API (<samp class="codeph nolang">true</samp>) or not (<samp class="codeph nolang">false</samp>).<p class="p">Use the external client app OAuth UI to
                  access consumer secrets.</p>
              </td>

            </tr>

            <tr>
              <td class="entry" headers="d472102e117" data-title="Field Name"><span class="keyword parmname">enablePackageEcaOauthFromDevOrg</span></td>

              <td class="entry" headers="d472102e120" data-title="Field Type">boolean</td>

              <td class="entry" headers="d472102e123" data-title="Description">Indicates whether you can package an external client app that is owned by an
                org, that isn't a Dev Hub org, (<samp class="codeph nolang">true</samp>) or not
                (<samp class="codeph nolang">false</samp>). It’s recommended that you only
                package OAuth-enabled external client apps that are owned by a Dev Hub org. This
                practice maintains the integrity of the OAuth client credentials by storing them on
                an org that won't be deleted. If you have other ways to maintain the OAuth client
                credentials, you can enable this field and package an external client app form a
                different type of org. External client apps built on ephemeral orgs, like Scratch
                orgs or sandboxes, can't be packaged even with this field set to true. This field is
                available in API version 62.0 and later.</td>

            </tr>

          </tbody>

        </table>

## Declarative Metadata Sample Definition

The example shows a settings file component.

<?xml version="1.0" encoding="UTF-8"?>
<ExternalClientAppSettings xmlns="http://soap.sforce.com/2006/04/metadata">
        <enableClientSecretInRestApiAccess\>true</enableClientSecretInRestApiAccess\>
        <enableConsumerSecretApiAccess\>true</enableConsumerSecretApiAccess\>
        <enablePackageEcaOauthFromDevOrg\>false</enablePackageEcaOauthFromDevOrg\>
</ExternalClientAppSettings\>

## Wildcard Support in the Manifest File

The wildcard character \* (asterisk) in the package.xml manifest file doesn’t apply to metadata types for feature settings. The wildcard applies only when retrieving all settings, not for an individual setting. For details, see [Settings](https://developer.salesforce.com/docs/atlas.en-us.264.0.api_meta.meta/api_meta/meta_settings.htm). For information about using the manifest file, see [Deploying and Retrieving Metadata with the Zip File](https://developer.salesforce.com/docs/atlas.en-us.264.0.api_meta.meta/api_meta/file_based_zip_file.htm).