---
schema_version: "1"
id: a0a8c0699527760a0ef07fb005dfd2a43ea89144795a6646249f8dcd0295b6b7
title: ExtlClntAppOauthConfigurablePolicies
collection: legacydeveloper
version: current
locale: en-us
portal_url: https://docs.salesforce.com/legacydeveloper/current/en-us/api_meta/meta_extlclntappoauthconfigurablepolicies.md
canonical_url: https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_extlclntappoauthconfigurablepolicies.htm
source_site: developer.salesforce.com
content_type: documentation
content_hash: 05503d23a24e99c34f8c2a22de1c7e1fde15b83cc8d8621e940c2081c9b8c3ea
description: Represents the policies configured by the admin for an OAuth-enabled external client app.
---
# ExtlClntAppOauthConfigurablePolicies

Represents the policies configured by the admin for an OAuth-enabled external client app.

## Parent Type

This type extends the [Metadata](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/metadata.htm "The base class for all metadata types. You can’t edit this object. A component is an instance of a metadata type.") metadata type and inherits its fullName field.

## File Suffix and Directory Location

ExtlClntAppOauthConfigurablePolicies components have the suffix .ecaOauthPlcy and are stored in the extlClntAppOauthPolicies folder.

## Version

ExtlClntAppOauthConfigurablePolicies components are available in API version 59.0 and later.

## Special Access Rules

The View all External Client Apps, view their settings, and edit their policies user permission is required for users with admin roles to configure OAuth policies.

## Fields

<table class="featureTable sort_table" summary="">


          <thead class="thead sorted" align="left">
            <tr>
              <th class="featureTableHeader  " id="d489630e101">Field Name</th>

              <th class="featureTableHeader  " id="d489630e104">Description</th>

            </tr>

          </thead>

          <tbody class="tbody">
            <tr>
              <td class="entry" headers="d489630e101" data-title="Field Name"><span class="keyword parmname">apexHandler</span></td>

              <td class="entry" headers="d489630e104" data-title="Description">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Field Type</dt>

                  <dd class="dd">string</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">Name of the Apex handler. Available in API version 61.0
                    and later.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry" headers="d489630e101" data-title="Field Name"><span class="keyword parmname">clientCredentialsFlowUser</span></td>

              <td class="entry" headers="d489630e104" data-title="Description">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Field Type</dt>

                  <dd class="dd">string</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The execution user for the OAuth 2.0 client credentials
                    flow. Salesforce returns access tokens on behalf of this
                    user. This user must have the API Only permission.
                    Available in API version 60.0 and later.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry" headers="d489630e101" data-title="Field Name"><span class="keyword parmname">commaSeparatedCustomScopes</span></td>

              <td class="entry" headers="d489630e104" data-title="Description">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Field Type</dt>

                  <dd class="dd">string</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">Custom scope names in a comma-separated list. Available
                    in API version 61.0 and later.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry" headers="d489630e101" data-title="Field Name"><span class="keyword parmname">commaSeparatedPermissionSet</span></td>

              <td class="entry" headers="d489630e104" data-title="Description">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Field Type</dt>

                  <dd class="dd">string</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">Permission set IDs in a comma-separated list. This field
                    or commaSeparatedProfile is used when
                    permittedUsersPolicyType is set to
                    AdminApprovedPreAuthorized.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry" headers="d489630e101" data-title="Field Name"><span class="keyword parmname">commaSeparatedProfile</span></td>

              <td class="entry" headers="d489630e104" data-title="Description">
                <a name="dl_m2t_dsp_3fc"><!-- --></a>
                <dl class="dl detailList" id="dl_m2t_dsp_3fc">

                  <dt class="dt dlterm">Field Type</dt>

                  <dd class="dd">string</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">Profiles in a comma-separated list. This field or
                    commaSeparatedPermissionSet is used when
                    permittedUsersPolicyType is set to
                    AdminApprovedPreAuthorized.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry" headers="d489630e101" data-title="Field Name"><span class="keyword parmname">customAttributes</span></td>

              <td class="entry" headers="d489630e104" data-title="Description">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Field Type</dt>

                  <dd class="dd"><a class="xref" href="#ExtlClntAppOauthPoliciesAttribute">ExtlClntAppOauthPoliciesAttribute[]</a></dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">Unique attributes to be included as admin defaults. The
                    maximum number accepted is 128. Each custom attribute
                    must have a unique key and use an available field.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry" headers="d489630e101" data-title="Field Name"><span class="keyword parmname">executeHandlerAs</span></td>

              <td class="entry" headers="d489630e104" data-title="Description">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Field Type</dt>

                  <dd class="dd">string</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">Username of the Apex handler's execution user. Available
                    in API version 61.0 and later.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry" headers="d489630e101" data-title="Field Name"><span class="keyword parmname">externalClientApplication</span></td>

              <td class="entry" headers="d489630e104" data-title="Description">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Field Type</dt>

                  <dd class="dd">string</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">
                    <p class="p">Required.</p>
                    The name of the external client app
                    associated with this OAuth policies file.
                  </dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry" headers="d489630e101" data-title="Field Name"><span class="keyword parmname">guestJwtTimeout</span></td>

              <td class="entry" headers="d489630e104" data-title="Description">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Field Type</dt>

                  <dd class="dd">int</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">If <span class="keyword parmname">guestJwtSessionTimeoutType</span> is
                    set to <samp class="codeph nolang">Custom</samp>, this
                    field defines the amount of time before a JWT-based
                    access token issued to a guest user expires. Values are
                    in minutes.<p class="p">These values are available in API version
                      61.0 and later.</p>
                    <ul class="ul bulletList">
                      <li class="li">
                        <samp class="codeph nolang">1</samp>—1
                        Minute
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">5</samp>—5
                        Minutes
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">10</samp>—10
                        Minutes
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">15</samp>—15
                        Minutes
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">30</samp>—30
                        Minutes
                      </li>

                    </ul>
                    These values are available in API version 65.0 and later.<ul class="ul bulletList">
                      <li class="li">
                        <samp class="codeph nolang">60</samp>—1
                        Hour
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">90</samp>—90
                        Minutes
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">120</samp>—2
                        Hours
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">240</samp>—4
                        Hours
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">480</samp>—8
                        Hours
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">720</samp>—12
                        Hours
                      </li>

                    </ul>
                    <p class="p">If
                      <span class="keyword parmname">guestJwtSessionTimeoutType</span> is
                      set to <samp class="codeph nolang">UserSession</samp>, omit this field.
                    </p>
                  </dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry" headers="d489630e101" data-title="Field Name"><span class="keyword parmname">guestJwtSessionTimeoutType</span></td>

              <td class="entry" headers="d489630e104" data-title="Description">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Field Type</dt>

                  <dd class="dd">JWTSessionTimeoutType (enumeration of type string)</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">Specifies how the JWT-based access token timeout is
                    defined for guest users. Valid values are:<ul class="ul bulletList">
                      <li class="li">
                        <span class="keyword parmname">UserSession</span>—Salesforce uses the value from the
                        <span class="keyword parmname">sessionTimeout</span> field in the
                        <a class="xref" href="https://developer.salesforce.com/docs/atlas.en-us.264.0.api_meta.meta/api_meta/meta_profilesessionsetting.htm" target="_blank">ProfileSessionSetting</a> type for the <a class="xref" href="https://help.salesforce.com/s/articleView?id=platform.rss_config_guest_user_profile.htm&amp;language=en_US" target="_blank">Experience Cloud
                          guest user profile</a>.<p class="p">If there's no profile
                          session timeout for the user, Salesforce uses the
                          <span class="keyword parmname">sessionTimeout</span> value from the
                          <a class="xref" href="https://developer.salesforce.com/docs/atlas.en-us.264.0.api_meta.meta/api_meta/meta_securitysettings.htm" target="_blank">SessionSettings</a> type.
                        </p>
                        <p class="p">If both are
                          defined, Salesforce defaults to the profile
                          session timeout.</p>
                      </li>

                      <li class="li">
                        <span class="keyword parmname">Custom</span>—Salesforce uses the
                        value from the
                        <span class="keyword parmname">guestJwtTimeout</span> field.
                      </li>

                    </ul>
                    <p class="p">Available in API version 65.0 and
                      later.</p>
                  </dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry" headers="d489630e101" data-title="Field Name"><span class="keyword parmname">ipRelaxationPolicyType</span></td>

              <td class="entry" headers="d489630e104" data-title="Description">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Field Type</dt>

                  <dd class="dd">string</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">
                    <p class="p">The policy that determines IP restrictions.</p>

                    <p class="p">Values are:</p>

                    <ul class="ul bulletList">
                      <li class="li"><samp class="codeph nolang">Enforce</samp></li>

                      <li class="li"><samp class="codeph nolang">Bypass</samp></li>

                      <li class="li"><samp class="codeph nolang">Bypass_2factor</samp></li>

                      <li class="li"><samp class="codeph nolang">Enforce_RelaxRefresh</samp></li>

                    </ul>

                  </dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry" headers="d489630e101" data-title="Field Name"><span class="keyword parmname">isClientCredentialsFlowEnabled</span></td>

              <td class="entry" headers="d489630e104" data-title="Description">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Field Type</dt>

                  <dd class="dd">boolean</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">If <samp class="codeph nolang">true</samp>, the client
                    credentials flow is enabled. The default value is
                    <samp class="codeph nolang">false</samp>.
                    Available in API version 60.0 and later.
                  </dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry" headers="d489630e101" data-title="Field Name"><span class="keyword parmname">isGuestCodeCredFlowEnabled</span></td>

              <td class="entry" headers="d489630e104" data-title="Description">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Field Type</dt>

                  <dd class="dd">boolean</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">If <samp class="codeph nolang">true</samp>, the
                    external client app can use the guest user variation of
                    the Authorization Code and Credentials Flow. To use this
                    flow variation, the external client app must also be
                    configured to issue JWT-based access tokens. The default
                    value is <samp class="codeph nolang">false</samp>.
                    Available in API version 61.0 and later.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry" headers="d489630e101" data-title="Field Name"><span class="keyword parmname">isNamedUserJwtEnabled</span></td>

              <td class="entry" headers="d489630e104" data-title="Description">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Field Type</dt>

                  <dd class="dd">boolean</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">Deprecated.</dd>

                  <dd class="dd">If <samp class="codeph nolang">true</samp>, the
                    external client app issues JWT-based access tokens
                    instead of opaque access tokens. If this field is
                    available, it means that the
                    <span class="keyword parmname">isNamedUserJwtEnabled</span> field in
                    the ExtlClntAppGlobalOauthSettings type is set to
                    <samp class="codeph nolang">true</samp>.
                  </dd>

                  <dd class="dd">The default value is <samp class="codeph nolang">false</samp>. Removed in API
                    version 64.0 and later.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry" headers="d489630e101" data-title="Field Name"><span class="keyword parmname">isTokenExchangeFlowEnabled</span></td>

              <td class="entry" headers="d489630e104" data-title="Description">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Field Type</dt>

                  <dd class="dd">boolean</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">If <samp class="codeph nolang">true</samp><strong class="ph uicontrol">true</strong>, the token
                    exchange flow is enabled. The default value is <samp class="codeph nolang">false</samp>. Available in API
                    version 60.0 and later.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry" headers="d489630e101" data-title="Field Name"><span class="keyword parmname">label</span></td>

              <td class="entry" headers="d489630e104" data-title="Description">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Field Type</dt>

                  <dd class="dd">string</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The OAuth policies name for the external client
                    app.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry" headers="d489630e101" data-title="Field Name"><span class="keyword parmname">namedUserJwtTimeout</span></td>

              <td class="entry" headers="d489630e104" data-title="Description">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Field Type</dt>

                  <dd class="dd">int</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">If <span class="keyword parmname">namedUserJwtSessionTimeoutType</span>
                    is set to <samp class="codeph nolang">Custom</samp>,
                    the amount of time before a JWT-based access token
                    issued to a named user expires. Values are in
                    minutes.<p class="p">These values are available in API version
                      61.0 and later.</p>
                    <ul class="ul bulletList">
                      <li class="li">
                        <samp class="codeph nolang">1</samp>—1
                        Minute
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">5</samp>—5
                        Minutes
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">10</samp>—10
                        Minutes
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">15</samp>—15
                        Minutes
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">30</samp>—30
                        Minutes
                      </li>

                    </ul>
                    These values are available in API version 65.0 and later.<ul class="ul bulletList">
                      <li class="li">
                        <samp class="codeph nolang">60</samp>—1
                        Hour
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">90</samp>—90
                        Minutes
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">120</samp>—2
                        Hours
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">240</samp>—4
                        Hours
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">480</samp>—8
                        Hours
                      </li>

                      <li class="li">
                        <samp class="codeph nolang">720</samp>—12
                        Hours
                      </li>

                    </ul>
                  </dd>


                </dl>

                <p class="p">If <span class="keyword parmname">namedUserJwtSessionTimeoutType</span> is set to
                  <samp class="codeph nolang">UserSession</samp>, omit this
                  field.
                </p>

              </td>

            </tr>

            <tr>
              <td class="entry" headers="d489630e101" data-title="Field Name"><span class="keyword parmname">namedUserJwtSessionTimeoutType</span></td>

              <td class="entry" headers="d489630e104" data-title="Description">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Field Type</dt>

                  <dd class="dd">JWTSessionTimeoutType (enumeration of type string)</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">Specifies how the JWT-based access token timeout is
                    defined for named users. Valid values are:<ul class="ul bulletList">
                      <li class="li">
                        <span class="keyword parmname">UserSession</span>—Salesforce uses
                        the value from the
                        <span class="keyword parmname">sessionTimeout</span> field in the
                        <a class="xref" href="https://developer.salesforce.com/docs/atlas.en-us.264.0.api_meta.meta/api_meta/meta_profilesessionsetting.htm" target="_blank">ProfileSessionSetting</a> type for the named
                        user's profile.<p class="p">If there's no profile session
                          timeout for the user, Salesforce uses the
                          <span class="keyword parmname">sessionTimeout</span> value from the
                          <a class="xref" href="https://developer.salesforce.com/docs/atlas.en-us.264.0.api_meta.meta/api_meta/meta_securitysettings.htm" target="_blank">SessionSettings</a> type.
                        </p>
                        <p class="p">If both are
                          defined, Salesforce defaults to the profile
                          session timeout.</p>
                      </li>

                      <li class="li">
                        <span class="keyword parmname">Custom</span>—Salesforce uses the
                        value from the
                        <span class="keyword parmname">namedUserJwtTimeout</span>
                        field.
                      </li>

                    </ul>
                    <p class="p">Available in API version 65.0 and
                      later.</p>
                  </dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry" headers="d489630e101" data-title="Field Name"><span class="keyword parmname">permittedUsersPolicyType</span></td>

              <td class="entry" headers="d489630e104" data-title="Description">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Field Type</dt>

                  <dd class="dd">PermittedUsersPolicyType (enumeration of type
                    string)</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The policy that determines which users are allowed in
                    the external client app.<p class="p">Values are:</p>
                    <ul class="ul bulletList">
                      <li class="li"><samp class="codeph nolang">AdminApprovedPreAuthorized</samp></li>

                      <li class="li"><samp class="codeph nolang">AllSelfAuthorized</samp></li>

                    </ul>
                  </dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry" headers="d489630e101" data-title="Field Name"><span class="keyword parmname">policyAction</span></td>

              <td class="entry" headers="d489630e104" data-title="Description">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Field Type</dt>

                  <dd class="dd">PolicyAction (enumeration of type string)</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">Requires users to verify their identity with two-factor
                    authentication when they log in to the external client
                    app. Use <samp class="codeph nolang">RaiseSessionLevel</samp> along with
                    <span class="keyword parmname">requiredSessionLevel</span> to
                    determine the security posture. <p class="p">Values are:</p>
                    <ul class="ul bulletList">
                      <li class="li"><samp class="codeph nolang">Block</samp></li>

                      <li class="li"><samp class="codeph nolang">RaiseSessionLevel</samp></li>

                    </ul>
                  </dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry" headers="d489630e101" data-title="Field Name"><span class="keyword parmname">refreshTokenPolicyType</span></td>

              <td class="entry" headers="d489630e104" data-title="Description">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Field Type</dt>

                  <dd class="dd">RefreshTokenPolicyType (enumeration of type string)</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The type of policy that determines when a token must be
                    refreshed.<p class="p">Values are:</p>
                    <ul class="ul bulletList">
                      <li class="li"><samp class="codeph nolang">Infinite</samp></li>

                      <li class="li"><samp class="codeph nolang">SpecificInactivity</samp></li>

                      <li class="li"><samp class="codeph nolang">SpecificLifetime</samp></li>

                      <li class="li"><samp class="codeph nolang">Zero</samp></li>

                    </ul>
                  </dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry" headers="d489630e101" data-title="Field Name"><span class="keyword parmname">refreshTokenValidityPeriod</span></td>

              <td class="entry" headers="d489630e104" data-title="Description">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Field Type</dt>

                  <dd class="dd">int</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The number of units of measure used to specify validity
                    when refresh token policy type is set to <samp class="codeph nolang">SpecificInactivity</samp> or
                    <samp class="codeph nolang">SpecificLifetime</samp>.
                  </dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry" headers="d489630e101" data-title="Field Name"><span class="keyword parmname">refreshTokenValidityUnit</span></td>

              <td class="entry" headers="d489630e104" data-title="Description">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Field Type</dt>

                  <dd class="dd">string</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">The unit of measurement that is used to specify validity
                    when refresh token policy type is set to <samp class="codeph nolang">SpecificInactivity</samp> or
                    <samp class="codeph nolang">SpecificLifetime</samp>.<p class="p">Values are:</p>
                    <ul class="ul bulletList">
                      <li class="li"><samp class="codeph nolang">Days</samp></li>

                      <li class="li"><samp class="codeph nolang">Hours</samp></li>

                      <li class="li"><samp class="codeph nolang">Months</samp></li>

                    </ul>
                  </dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry" headers="d489630e101" data-title="Field Name"><span class="keyword parmname">requiredSessionLevel</span></td>

              <td class="entry" headers="d489630e104" data-title="Description">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Field Type</dt>

                  <dd class="dd">SessionSecurityLevel (enumeration of type string)</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">Defines the security posture.<p class="p">Values are:</p>
                    <ul class="ul bulletList">
                      <li class="li"><samp class="codeph nolang">HIGH_ASSURANCE</samp></li>

                      <li class="li"><samp class="codeph nolang">LOW</samp></li>

                      <li class="li"><samp class="codeph nolang">STANDARD</samp></li>

                    </ul>
                  </dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry" headers="d489630e101" data-title="Field Name"><span class="keyword parmname">sessionTimeoutInMinutes</span></td>

              <td class="entry" headers="d489630e104" data-title="Description">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Field Type</dt>

                  <dd class="dd">int</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">Length of time the external client app’s session lasts.
                    This field applies only if the app issues opaque
                    tokens.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry" headers="d489630e101" data-title="Field Name"><span class="keyword parmname">singleLogoutUrl</span></td>

              <td class="entry" headers="d489630e104" data-title="Description">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Field Type</dt>

                  <dd class="dd">string</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">URL where Salesforce sends a logout request when users
                    log out of Salesforce.</dd>


                </dl>

              </td>

            </tr>

            <tr>
              <td class="entry" headers="d489630e101" data-title="Field Name"><span class="keyword parmname">startUrl</span></td>

              <td class="entry" headers="d489630e104" data-title="Description">
                <dl class="dl detailList">

                  <dt class="dt dlterm">Field Type</dt>

                  <dd class="dd">string</dd>



                  <dt class="dt dlterm">Description</dt>

                  <dd class="dd">URL where users are directed after they
                    authenticate.</dd>


                </dl>

              </td>

            </tr>

          </tbody>

        </table>

## ExtlClntAppOauthPoliciesAttribute

Represents admin-defined attributes that provide personal information to customize the external client app for a specific use case.

| Field Name | Description |
| --- | --- |
| formula | 
Field Type

string

Description

Required.

The existing field that includes the desired information. For example, Organization.Country.



 |
| key | 

Field Type

string

Description

Required.

A unique name for the attribute. For example, country.



 |

## Declarative Metadata Sample Definition

This example shows an ExtlClntAppOauthConfigurablePolicies component.

<?xml version="1.0" encoding="UTF-8"?>
<ExtlClntAppOauthConfigurablePolicies xmlns="http://soap.sforce.com/2006/04/metadata">
    <externalClientApplication>myeca</externalClientApplication>
    <label>myecapolicy</label>
    <apexHandler>MyEcaOauthApexHandler</apexHandler>
    <executeHandlerAs>admin@example.org</executeHandlerAs>
    <refreshTokenPolicyType>SpecificLifetime</refreshTokenPolicyType>
    <refreshTokenValidityPeriod>1</refreshTokenValidityPeriod>
    <refreshTokenValidityUnit>Days</refreshTokenValidityUnit>
    <ipRelaxationPolicyType>Enforce</ipRelaxationPolicyType>
    <permittedUsersPolicyType>AdminApprovedPreAuthorized</permittedUsersPolicyType>
    <commaSeparatedPermissionSet>PermSetExample</commaSeparatedPermissionSet>
    <commaSeparatedCustomScopes>CustomScopeExample</commaSeparatedCustomScopes>
    <sessionTimeoutInMinutes>1</sessionTimeoutInMinutes>
    <requiredSessionLevel>HIGH\_ASSURANCE</requiredSessionLevel>
    <policyAction>RaiseSessionLevel</policyAction>
    <singleLogoutUrl>https://www.example.com</singleLogoutUrl>
    <startUrl>https://www.example.com</startUrl>
    <guestJwtSessionTimeoutType>UserSession</guestJwtSessionTimeoutType>
    <namedUserJwtSessionTimeoutType>Custom</namedUserJwtSessionTimeoutType>
    <namedUserJwtTimeout>10</namedUserJwtSessionTimeout>
</ExtlClntAppOauthConfigurablePolicies>

This example package.xml that references the previous definition.

<?xml version="1.0" encoding="UTF-8"?>
<Package xmlns="http://soap.sforce.com/2006/04/metadata">
    <types\>
        <members\>\*</members\>
        <name\>ExternalClientApplication</name\>
    </types\>
    <types\>
        <members\>\*</members\>
        <name\>ExtlClntAppOauthSettings</name\>
    </types\>
    <types\>
        <members\>\*</members\>
        <name\>ExtlClntAppGlobalOauthSettings</name\>
    </types\>
    <types\>
        <members\>\*</members\>
        <name\>ExtlClntAppOauthConfigurablePolicies</name\>
    </types\>
    <types\>
        <members\>\*</members\>
        <name\>ExtlClntAppConfigurablePolicies</name\>
    </types\>
    <version\>60.0</version\>
</Package\>

## Wildcard Support in the Manifest File

This metadata type supports the wildcard character \* (asterisk) in the package.xml manifest file. For information about using the manifest file, see [Deploying and Retrieving Metadata with the Zip File](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/file_based_zip_file.htm "The deploy() and retrieve() calls are used to deploy and retrieve a .zip file. Within the .zip file is a project manifest (package.xml) that lists what to retrieve or deploy, and one or more XML components that are organized into folders.").