The flow can be invoked from a user-facing process. Here are the parameters: - `/services/auth/xds` - external data service handler will issue the logout redirect, - `&startURL=/0XA...` - the Named Credential ID tells SF what to link the grant against, - `&scope=full` - list of scopes or privileges presented to the user in the Grant Access screen, Apex code to return such a URL from a VF page action or button: public PageReference authorizeNamedCredential(String authProvider, String namedCredential) { AuthProvider provider = [ SELECT Id FROM AuthProvider WHERE DeveloperName = :authProvider ]; NamedCredential credential = [ SELECT Id FROM NamedCredential WHERE DeveloperName = :namedCredential ]; String oid = UserInfo.getOrganizationId(); String domain = Url.getOrgDomainUrl().toExternalForm(); String path = '/services/auth/xds/' + oid + '/' + authProvider; String startUrl = '/' + String.valueOf(credential.Id).left(15); PageReference redirect = new PageReference(domain + path); redirect.getParameters().put('startURL', startUrl); redirect.getParameters().put('scope', 'full refresh_token'); return redirect; }