A grounded, agentic sports booking concierge

Create the ECA that issues access tokens via the client-credentials flow.

1. From Setup, in the Quick Find box, enter External Client App, then select External Client Apps Manager.
2. Select New External Client App.
3. Specify a name — e.g. PW_Agent_External_API.
4. Select Enable OAuth and use these OAuth scopes:
   • Manage user data via APIs (api)
   • Perform requests at any time (refresh_token, offline_access)
   • Access chatbot services (chatbot_api)
   • Access the Salesforce API Platform (sfap_api)
5. Select these additional OAuth settings:
   • Enable Client Credentials Flow
   • Issue JSON Web Token (JWT)-based access tokens for named users
6. Create the app.
7. From your app settings, click the Policy tab › Edit.
8. From the OAuth Flows and External Client App Enhancements section, check Enable Client Credentials Flow.
9. Set the Run As (Username) field to the email address of a user that has at least API Only access.

Wire the OAuth chain so Apex callouts authenticate automatically — no secrets in code.

1. Enter Named Credentials in the Quick Find box and click Named Credentials.
2. Click the External Credentials tab and click New:
   1. Name: PW_Agent
   2. Authentication Protocol: OAuth 2.0
   3. Authentication Flow Type: Client Credentials with Client Secret Flow
   4. Identity Provider URL: https://[Your_Domain_Name]/services/oauth2/token
3. Under Principals in the External Credential, click New to create a principal entry:
   1. Parameter Name: PW_Agent
   2. Enter your Consumer Key as the Client ID and your Consumer Secret as the Client Secret — obtain both from the ECA settings in step 1.

The PW_Chat_Guest_Access permission set grants the site guest user exactly what it needs to broker a call — and nothing more.

1. Apex class access: enable PW_AgentController so the guest user can invoke the controller that brokers the Agent API.
2. UserExternalCredential read: grant Read so the guest user can resolve the external credential at callout time.
3. External Credential Principal Access: enable the PW_Agent principal so the Named Credential can attach the issued token.
4. Assign the permission set to the Experience site guest user.

How the pieces above combine into a safe public boundary (and what to tighten for production).

• Credentials server-side only — tokens are issued and attached by the Named Credential inside Apex; the browser never sees them.
• Least privilege — the guest user gets only Apex class access plus the external-credential principal, nothing else.
• Run As an API-Only user — the ECA executes under a constrained identity, limiting blast radius.
• Recommended production hardening — per-conversation rate limiting, monitoring / trace review, tighter guest data scoping, and rotation of the Consumer Secret.