This is a question about using OAuth 2.0 protocol with Salesforce's Named and External Credentials.

I created an External Credential with OAuth, Client/Secret, and token ID URL. I created the Principal with the ClientId and Secret, configured the permission set and assigned it to myself. I also created a related Named Credential with the base API endpoint.

I've tried every combination of headers in the External, headers in the Named, no headers, "Generate Header Automatically", custom header, etc, but I constantly receive the following error: "Unable to fetch the OAuth token. Error: invalid_scope. Error description: ."

If I hardcode the auth credentials, I have no problem with my HTTP callout. I send the grant_client body with the ClientId and Secret to the auth endpoint and fetch a token then proceed as normal, but I cannot seem to access the credentials using the Named/External credential system. Have I missed a step? Unfortunately the error message is not giving me a lot of direction.

I've tried the solution commented here: External + Named Credential with oAuth client credentials flow

Similar question was asked here, which I also tried (but with two API endpoints instead of a single base endpoint): Using a custom authentication endpoint with an external credential

  • Not much help, but I followed the instructions in External + Named Credential with oAuth client credentials flow and it worked perfectly.
    – Nick C
    Commented Sep 15, 2023 at 0:50
  • Welcome to SFSE! Please take a moment to read How to Ask and take the tour. Including a Minimal, Complete and Reproducible Example would be helpful.
    – identigral
    Commented Sep 15, 2023 at 17:17

1 Answer 1


The trick here was to utilise the "Scope" category on the top of the External Credential. Filling this out and using the "Generate Header" on the Named Credential sent the following body automatically for my token:


Here is the documentation about Scope (which I initially found confusing): https://help.salesforce.com/s/articleView?id=sf.nc_create_edit_oath_ext_cred.htm&type=5


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .