afv-library/skills/integration-connectivity-generate/assets/external-credentials/jwt-external-credential.externalCredential-meta.xml

<?xml version="1.0" encoding="UTF-8"?>
<!--
    External Credential Template: JWT (API 61+)

    Use Case: JWT Bearer authentication for server-to-server
    - Machine-to-machine authentication
    - Service account integrations
    - High-security API access

    API Version: 61.0+ (Spring '24+) REQUIRED

    Prerequisites:
    1. Create certificate in Setup → Certificate and Key Management
    2. Register public key with external system
    3. Configure JWT claims as required by external API

    Setup Steps:
    1. Replace all {{placeholder}} values
    2. Upload certificate to Salesforce
    3. Deploy to org
    4. Create Named Credential referencing this External Credential

    File Location: force-app/main/default/externalCredentials/{{CredentialName}}.externalCredential-meta.xml
-->
<ExternalCredential xmlns="http://soap.sforce.com/2006/04/metadata">
    <label>{{CredentialLabel}}</label>

    <!-- JWT Authentication Protocol -->
    <authenticationProtocol>Jwt</authenticationProtocol>

    <!--
    JWT Configuration Parameters
    -->

    <!-- Issuer claim (iss) - typically your client ID or service identifier -->
    <externalCredentialParameters>
        <parameterName>issuer</parameterName>
        <parameterType>SigningCertificate</parameterType>
        <parameterValue>{{CertificateName}}</parameterValue>
    </externalCredentialParameters>

    <!-- Subject claim (sub) - the identity being asserted -->
    <externalCredentialParameters>
        <parameterName>subject</parameterName>
        <parameterType>Custom</parameterType>
        <parameterValue>{{SubjectIdentifier}}</parameterValue>
    </externalCredentialParameters>

    <!-- Audience claim (aud) - intended recipient of the JWT -->
    <externalCredentialParameters>
        <parameterName>audience</parameterName>
        <parameterType>Custom</parameterType>
        <parameterValue>{{AudienceUrl}}</parameterValue>
    </externalCredentialParameters>

    <!-- Token endpoint for JWT exchange -->
    <externalCredentialParameters>
        <parameterName>tokenEndpoint</parameterName>
        <parameterType>AuthProviderTokenEndpoint</parameterType>
        <parameterValue>{{TokenEndpoint}}</parameterValue>
    </externalCredentialParameters>

    <!-- JWT Expiration (in seconds) -->
    <externalCredentialParameters>
        <parameterName>expirationOffset</parameterName>
        <parameterType>Custom</parameterType>
        <parameterValue>3600</parameterValue>
    </externalCredentialParameters>

    <!-- Named Principal for JWT auth -->
    <principals>
        <principalName>{{PrincipalName}}</principalName>
        <principalType>NamedPrincipal</principalType>
        <sequenceNumber>1</sequenceNumber>
    </principals>

    <!--
    JWT Token Flow:
    1. Salesforce creates JWT with claims (iss, sub, aud, exp)
    2. JWT signed with certificate private key
    3. JWT sent to token endpoint
    4. External system validates signature with public key
    5. Access token returned
    6. Access token used for API calls

    Custom Claims:
    Add additional externalCredentialParameters with parameterType="Custom"
    to include custom claims required by your external system.
    -->
</ExternalCredential>