I am trying to create a named credential to authorize access to the Salesforce metadata API, as explained in this blog: https://gscloudsolutions.com/tips-tricks/using-named-credentials-with-the-apex-wrapper-salesforce-metadata-api/
But I am unable to authenticate the Named Credential. When I save the credential I am prompted to login as expected, but I get:
Problem Logging In
We can’t log you in because of an authentication error. For help, contact your Salesforce administrator.
The URL shown is
https://<my domain>.my.salesforce.com/_nc_external/identity/sso/ui/AuthorizationError?ErrorCode=Remote_Error&ErrorDescription=OAUTH_DISALLOWED_SCOPES&ProviderId=<provider ID>
The relevant part seems to be the OAUTH_DISALLOWED_SCOPES -- but I have triple checked all the settings and they all have full refresh_token offline_access as per the instructions.
The user is a System Administrator and I have added a permission set with everything that I could find that seemed relevant.
I have also tried it with the new style External Credentials and it has the same issue.
I'm out of ideas.... Any pointers would be super welcome!
