In my Salesforce org, I have configured Named Credentials and External Credentials using the OAuth 2.0 Client Credentials with Client Secret Flow to connect to an external system.
Since our org is highly configuration-driven and relies heavily on Flows, I was hoping to use External Services so that the integrations could be invoked easily from Flow.
However, I haven't been able to find any documentation or articles explaining how External Services work with Named Credentials and External Credentials that are configured using the Client Credentials Flow.
I have registered an External Service using the Named Credential mentioned above. When I try to invoke the External Service action from a Flow, it prompts for an Authorization parameter. I assume this parameter expects an access token, but I'm not sure how that token should be supplied through Flow, especially since the authentication is already configured through the Named Credential and External Credential setup.
Has anyone implemented this successfully or can provide guidance on the correct approach? Any help would be greatly appreciated.
Good news, this is solvable, and it's almost certainly a schema issue, not a fundamental limitation.
Root cause: With Client Credentials Flow, the Named Credential/External Credential is supposed to fetch and inject the token automatically you should never need to supply it manually. The fact that Flow is prompting for an "Authorization" input almost always means the OpenAPI schema you registered for the External Service explicitly defines Authorization as a header parameter (common when a schema is auto generated from Postman/Swagger export, which bakes in an Authorization header as part of the spec). External Services then dutifully surfaces that as a required input on the Flow action even though the Named Credential is already handling auth underneath it.
Fix:
- Open the OpenAPI schema registered on your External Service (Setup → External Services → your service → Actions/Schema).
- Find the Authorization header parameter definition on the relevant operation(s) remove it entirely or set it to required: false and don't map it in Flow.
- Re-save/re validate the External Service so it regenerates the invocable action without that input.
- Separately, confirm on the External Credential itself: the Principal has "Generate Authorization Header" (or equivalent auto-token-injection setting) enabled, and the running user has access via External Credential Principal Access (Setup → your External Credential → Edit Principal Access, or Permission Set External Credential Principal Mappings pre-Winter '25 style naming).
Once the schema no longer declares Authorization as a parameter the Flow action should drop that input field and the Named Credential will inject the token transparently on every callout same as it would in Apex.
If after removing it from the schema Flow still prompts, double check you're invoking the action through
External Services (not a raw HTTP Callout elementpointed at the Named Credential with a manually-built header) those are two different Flow elements and it's easy to end up on the wrong one when troubleshooting.
I hope you find the above information helpful. If it does, please mark it as Best Answer to help others too.