OAuth 2.0 in External Credential

Question

This is a question about using OAuth 2.0 protocol with Salesforce's Named and External Credentials.

I created an External Credential with OAuth, Client/Secret, and token ID URL. I created the Principal with the ClientId and Secret, configured the permission set and assigned it to myself. I also created a related Named Credential with the base API endpoint.

I've tried every combination of headers in the External, headers in the Named, no headers, "Generate Header Automatically", custom header, etc, but I constantly receive the following error: "Unable to fetch the OAuth token. Error: invalid_scope. Error description: ."

If I hardcode the auth credentials, I have no problem with my HTTP callout. I send the grant_client body with the ClientId and Secret to the auth endpoint and fetch a token then proceed as normal, but I cannot seem to access the credentials using the Named/External credential system. Have I missed a step? Unfortunately the error message is not giving me a lot of direction.

I've tried the solution commented here: External + Named Credential with oAuth client credentials flow

Similar question was asked here, which I also tried (but with two API endpoints instead of a single base endpoint): Using a custom authentication endpoint with an external credential

Answer 1

The trick here was to utilise the "Scope" category on the top of the External Credential. Filling this out and using the "Generate Header" on the Named Credential sent the following body automatically for my token:

grant_type=client_credentials&client_id={{ClientId}}&client_secret={{Secret}}&scope={{Scope}}

Here is the documentation about Scope (which I initially found confusing): https://help.salesforce.com/s/articleView?id=sf.nc_create_edit_oath_ext_cred.htm&type=5