I'm trying to use the External Services feature to call a REST-based SMS API for the two-factor authentication of our Community users. (Basically recreating this scenario, but with an External Service instead of the Apex callout: https://developer.salesforce.com/docs/atlas.en-us.securityImplGuide.meta/securityImplGuide/security_3p_sms_2fa_login_flow.htm).
For this I have defined the OpenApi schema of the service, created the named credential, the service and the flow. And everything is working fine, when I debug the flow as an administrator.
But, when I set it up as a login flow for Community users, I get the error:
Error Occurred During Flow "SMSTwoFactorAuth": Action name not found: (...)__Service
The action name is the auto-generated Apex action for the External Service I can see in the Flow editor.
Is there any limitation of the External Services, that they cannot be used by Community users? This auto-generated class does not appear in the regular classes list, so I can't e.g. add it to the list of class permissions for the community profile.