# Connected app OAuth settings, scopes and permitted users

*Platform Identity and Access Management Architect Study Guide · Salesforce as an Identity Provider · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/identity-and-access-management-architect/salesforce-as-an-identity-provider/connected-app-oauth-settings-scopes-and-permitted-users*

Which OAuth settings a connected app or external client app needs for each flow (callback URL, device flow, client credentials with a Run As user, PKCE and the web server secret), how to pick least-privilege scopes, and how Permitted Users and the Use Any API Client permission decide who can authorize.

- Certification: Salesforce Platform Identity and Access Management Architect
- Exam section: Salesforce as an Identity Provider
- Study guide: https://www.certifyforce.com/study-guide/identity-and-access-management-architect

**Official exam objective:**

> Given a scenario, recommend appropriate scope and configuration of the connected app for authorization.

## What the exam expects

- Configure a connected app's OAuth settings for the chosen flow: callback URL, device flow, client credentials with an execution user, PKCE and the web server secret.
- Recommend the least-privilege set of OAuth scopes for a described app, and predict which scopes a token actually receives.
- Choose a Permitted Users policy and grant access through profiles or permission sets, and explain how the Use Any API Client permission bypasses it.
- Key terms: **callback URL** (the registered redirect URIs an authorization request must match); **scope** (a permission granted with the token, such as api or openid); **Permitted Users** (the policy deciding whether users self-authorize or must be pre-authorized); **execution user** (the Run As user client credentials tokens act for).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Callback URL limit | 2000 characters in total; separate URLs with line breaks | [Enable OAuth Settings](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create_api_integration.htm&language=en_US&type=5) |
| redirect_uri_mismatch | Redirect URI doesn't match the app definition | [Authorization Errors](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_flow_errors.htm&language=en_US&type=5) |
| JWT certificate | Use Digital Signatures; 4,000 characters, under 4 KB | [Enable OAuth Settings](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create_api_integration.htm&language=en_US&type=5) |
| Client credentials execution user | Required; Permitted Users policies don't apply to it | [Client Credentials Setup](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_client_credentials_setup.htm&language=en_US&type=5) |
| Omitted scope parameter | All scopes assigned to the app are requested | [Web Server Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_web_server_flow.htm&language=en_US&type=5) |
| full scope | Doesn't return a refresh token | [OAuth Tokens and Scopes](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_tokens_scopes.htm&language=en_US&type=5) |
| id scope | Included in all scope values | [OAuth Tokens and Scopes](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_tokens_scopes.htm&language=en_US&type=5) |
| Permitted Users default | All users may self-authorize | [Manage OAuth Access Policies](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_oauth.htm&language=en_US&type=5) |
| Use Any API Client | Access to any connected app, even admin-approved ones | [Manage OAuth Access Policies](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_oauth.htm&language=en_US&type=5) |

## Check yourself

- Why does a redirect_uri_mismatch error follow a portal's move to a new host name?
- When does an app need to request the id scope separately?
- Which scope lets an external app check whether the signed-in user has a custom permission?
- When do current users lose access to an app after a policy change?

## Sources

- [Enable OAuth Settings for API Integration](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create_api_integration.htm&language=en_US&type=5)
- [OAuth Tokens and Scopes](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_tokens_scopes.htm&language=en_US&type=5)
- [Manage OAuth Access Policies for a Connected App](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_oauth.htm&language=en_US&type=5)
- [Configure a Connected App for the OAuth 2.0 Client Credentials Flow](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_client_credentials_setup.htm&language=en_US&type=5)
- [Configure the External Client App OAuth Settings](https://help.salesforce.com/s/articleView?id=xcloud.configure_external_client_app_oauth_settings.htm&language=en_US&type=5)
- [OAuth 2.0 Web Server Flow for Web App Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_web_server_flow.htm&language=en_US&type=5)
- [OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_jwt_flow.htm&language=en_US&type=5)
- [OAuth 2.0 Client Credentials Flow for Server-to-Server Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_client_credentials_flow.htm&language=en_US&type=5)
- [OAuth 2.0 Device Flow for IoT Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_device_flow.htm&language=en_US&type=5)
- [OAuth 2.0 Authorization Errors](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_flow_errors.htm&language=en_US&type=5)
- [Connected Apps](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_overview.htm&language=en_US&type=5)
- [Proof Key for Code Exchange (PKCE) Extension](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_pkce.htm&language=en_US&type=5)
- [Restrict the OAuth 2.0 Device Flow to Local External Client Apps (Release Update)](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_device_flow_restrictions.htm&language=en_US&release=262&type=5)
- [Configure a JWT Bearer Flow (External Client Apps)](https://help.salesforce.com/s/articleView?id=xcloud.configure_oauth_jwt_flow_external_client_apps.htm&language=en_US&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 11 linked practice questions, and unlimited timed mock exams are included with the Platform Identity and Access Management Architect pack (USD $19): https://www.certifyforce.com/practice-exams