ExtlClntAppGlobalOauthSettings

Represents the global settings for the OAuth plugin in an external client app. These settings include private and sensitive OAuth consumer information that can’t be packaged and must not be added to source control.

This type extends Metadata and inherits its fields.

ExtlClntAppGlobalOauthSettings components have the suffix .ecaGlblOauth and are stored in the extlClntAppGlobalOauthSets folder.

Introduced in API version 59.0.

Access to the OAuth plugin requires orgs to enable the Allow Access to OAuth Consumer Secrets via Metadata API permission in Setup. The View External Client Apps Consumer Secrets in Metadata user permission is required for users with developer roles to configure global OAuth settings.

• Type: string
• Required: No
• Description: The endpoint that Salesforce calls back to your external client app during OAuth. It’s the OAuth redirect_uri.

• Type: string
• Required: No
• Introduced: API version 60.0
• Description: If the app uses a certificate, the PEM-encoded certificate string. When provided, it enables the JWT Bearer flow.

• Type: string
• Required: No
• Description: A value used by the consumer for identification to Salesforce. Referred to as client_id in OAuth 2.0.

• Type: string
• Required: No
• Description: A value that is combined with the consumerKey and used by the consumer for identification to Salesforce. Referred to as client_secret in OAuth 2.0.

• Type: string

• Required: Yes

• Description: Required.

  Name of the external client application.

• Type: ExternalAppIdTokenConfig
• Required: No
• Description: The settings for the ID token.

• Type: boolean
• Required: No
• Introduced: API version 60.0
• Description: If set to true, the OAuth 2.0 client credentials flow is enabled.

• Type: boolean

• Required: No

• Introduced: API version 61.0

• Description: If set to true, the external client app can use the Authorization Code and Credentials Flow and its variations for headless login, passwordless login, and guest user identity services in an off-platform app. Headless registration isn’t currently supported for external client apps. The default value is false.

  To use this field, the Authorization Code and Credentials Flow must be enabled for your org in OAuth and OpenID Connect settings.

• Type: boolean
• Required: No
• Description: If set to true, for the Authorization Code and Credentials Flow, the external client app is required to send the user’s credentials to the Salesforce services/oauth2/authorize endpoint in the body of a POST request. If set to false, the app can send a POST or GET request with the user’s credentials in the request body or in a Basic authorization header. The default value is false.

• Type: boolean
• Required: No
• Description: If set to false (default), the external app’s client secret is required in exchange for an access token in the OAuth 2.0 web server flow. If set to true, the external app’s client secret is optional.

• Type: boolean
• Required: No
• Introduced: API version 60.0
• Description: If set to true, the external client app can use the OAuth 2.0 device flow.

• Type: boolean
• Required: No

• Type: boolean
• Required: No

• Type: boolean
• Required: No
• Description: If set to true, authorizes the external app to introspect all access and refresh all tokens. If set to false (default), the external client app can introspect its own tokens.

• Type: boolean
• Required: No

• Type: boolean

• Required: No

• Description: If set to true, the external client app issues JSON Web Token (JWT)-based access tokens. If set to false, it issues opaque access tokens. The default value is false

  Available in API version 61.0 and later.

• Type: boolean
• Required: No
• Description: If set to true (default) Proof Key for Code for Exchange (PKCE) is required for OAuth integration. If set to false, PKCE is optional.

• Type: boolean
• Required: No
• Introduced: API version 60.0
• Description: If set to true, the refresh token rotation is enabled.

• Type: boolean
• Required: No
• Description: If set to true (default), the app’s client secret is required in the authorization request of a refresh token and hybrid refresh token flow. If set to false and an app sends the client secret in the authorization request, Salesforce still validates it.

• Type: boolean
• Required: No
• Introduced: API version 60.0
• Description: If set to true, the app’s client secret is required for token exchange.

• Type: boolean
• Required: No
• Introduced: API version 60.0
• Description: If set to true, token exchange is enabled.

• Type: string
• Required: No
• Description: External Client Application Global OAuth Settings name.

• Type: boolean
• Required: No
• Description: If set to true, the OAuth external client app’s consumer key is replaced with a newly generated key on metadata deploy.. To maintain security, if this field is set to true, you must include the ignore warnings attribute in the deploy command. Default is false.

• Type: boolean
• Required: No
• Description: If set to true, the OAuth external client app’s consumer secret is replaced with a newly generated secret on metadata deploy. To maintain security, if this field is set to true, you must include the ignore warnings attribute in the deploy command. Default is false.

Represents configurations that determine the ID token attributes.

• Type: string
• Required: No
• Description: The audience that this ID token is intended for. The value is an array of case-sensitive strings. If no audiences are specified, the client_id of the relying party is returned as the default audience. Otherwise, the other audiences are returned with the client_id in the aud value.

• Type: boolean
• Required: No
• Description: Indicates whether attributes are included in the ID token (true) or not (false).

• Type: boolean
• Required: No

• Type: boolean
• Required: No
• Description: Indicates whether standard claims about the authentication event are included in the ID token (true) or not (false).

• Type: int
• Required: No
• Description: The length of time that the ID token is valid for after it’s issued. The value can be 1–720 minutes. The default value is 2 minutes.

This example shows an ExtlClntAppGlobalOauthSettings component.

1<?xml version="1.0" encoding="UTF-8"?>
2<ExtlClntAppGlobalOauthSettings xmlns="http://soap.sforce.com/2006/04/metadata">
3    <callbackUrl>https://www.example.com</callbackUrl>
4    <externalClientApplication>myeca</externalClientApplication>
5    <idTokenConfig>
6        <idTokenAudience>SalesforceAudience</idTokenAudience>
7        <idTokenIncludeStandardClaims>true</idTokenIncludeStandardClaims>
8        <idTokenValidityInMinutes>0</idTokenValidityInMinutes>
9    </idTokenConfig>
10    <isConsumerSecretOptional>false</isConsumerSecretOptional>
11    <isIntrospectAllTokens>false</isIntrospectAllTokens>
12    <isPkceRequired>true</isPkceRequired>
13    <isSecretRequiredForRefreshToken>false</isSecretRequiredForRefreshToken>
14    <label>myecaglobalset</label>
15    <shouldRotateConsumerKey>false</shouldRotateConsumerKey>
16    <shouldRotateConsumerSecret>false</shouldRotateConsumerSecret>
17</ExtlClntAppGlobalOauthSettings>

This example package.xml references the previous definition.

1<?xml version="1.0" encoding="UTF-8"?>
2<Package xmlns="http://soap.sforce.com/2006/04/metadata">
3    <types>
4        <members>*</members>
5        <name>ExternalClientApplication</name>
6    </types>
7    <types>
8        <members>*</members>
9        <name>ExtlClntAppOauthSettings</name>
10    </types>
11    <types>
12        <members>*</members>
13        <name>ExtlClntAppGlobalOauthSettings</name>
14    </types>
15    <types>
16        <members>*</members>
17        <name>ExtlClntAppOauthConfigurablePolicies</name>
18    </types>
19    <types>
20        <members>*</members>
21        <name>ExtlClntAppConfigurablePolicies</name>
22    </types>
23    <version>60.0</version>
24</Package>

This metadata type supports the wildcard character * (asterisk) in the package.xml manifest file. For information about using the manifest file, see Deploying and Retrieving Metadata with the Zip File.