Restrict access to the External Client App so that only admin-approved users with the required profiles or permission sets can use it.
1Open the External Client App in External Client App Manager and go to the Policies tab.
3Expand OAuth Policies and set Permitted Users to Admin approved users are pre-authorized.
5In App Policies, add the required profiles or permission sets to the Selected Profiles or Selected Permission Sets lists.
6Assign the permission set to the required users from Setup > Permission Sets > your permission set > Manage Assignments.