Creating an External Named Credential in SFDC

1. In Salesforce, navigate to Named Credentials.

2. Click the External Credentials tab and then click New.

3. In the New External Credential window, enter the Label and the Name, and then select JWT for the Authentication Protocol.

4. Complete the following: 

   Field	Description
   Issuer (iss)	Enter the Salesforce Organization ID. You can find this on the Company Information page in Salesforce.
   Subject (sub)	Enter the Client ID that you used when you created the Cloud Service Provider Account for SFDC. This was called the Customer Key in Salesforce.
   Audience (aud)	Enter the name of the Cloud Service Provider Account that you created.
   JWT Expiration (in seconds)	Set to 600 seconds (10 minutes).
   Signing Certificate	Enter the name of the wrapping certificate that you used when you created the Cloud Service Provider Account for SFDC.
   Signing Algorithm	Select RS256.

5. Click Save.

6. In the Principals section, click New.

7. In the Create Principal window, complete the following: 

   Field	Description
   Parameter Name	Enter a name for the principal.
   Identity Type	Select Named Principal.

8. Click Save.

9. Return to Named Credentials.

10. Click the Named Credentials tab, and click New.

11. In the Named Credentials window, enter the Label and the Name.

12. Enter the URL that you want to use for the callouts in the format https://<Cryptographic Security Platform Vault for Cloud Keys IP Address>/v5/sfdc.

    The Cryptographic Security Platform Vault for Cloud Keys must have a publicly rootable address and a publicly signed certificate in order to communicate with Salesforce.

13. Under Authentication, select the External Credential that you created.

14. Click Save.

15. Navigate to Users > Permission Sets.

16. Create a permissions set that has permissions for the user to access external credentials.

17. Return to the named credential that you created and copy the ID from the URL. The ID is located after /NamedCredential/.