--- schema_version: "1" id: 52f08f5f834f15eea2ce2a89c085099965e3d3c628f9a004e603175467eab1f8 title: Add Configuration Security by Using Named Credentials collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/data_mask_using_named_credentials.md canonical_url: https://help.salesforce.com/s/articleView?id=platform.data_mask_using_named_credentials.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: ecaa7d090d7488e553800cc658eef12c1fd1ecf411e5331c474fc1a68bb10ad6 description: If your organization requires heightened security when making configuration changes, enhance your Data Mask configuration security. Use a named credential with an Auth provider and a connected app to provide a secure connection to the Salesforce Metadata API. This feature is available in Data Mask version 4.2 and later. products: - Salesforce Platform release: "264" --- # Add Configuration Security by Using Named Credentials If your organization requires heightened security when making configuration changes, enhance your Data Mask configuration security. Use a named credential with an Auth provider and a connected app to provide a secure connection to the Salesforce Metadata API. This feature is available in Data Mask version 4.2 and later. ### Required Editions

Available in: Lightning Experience

Available in: Professional, Enterprise, Unlimited, and Developer Editions with the Salesforce Data Mask managed package (Legacy) add-on license.

User Permissions Needed
To view named credentials:	View Setup and Configuration
To create, edit, or delete named credentials:	Manage Named Credentials or Customize Applications

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-deploy_sandboxes-264-0-0-production-enus/654e51d1-6795-49fe-bd43-b5385950cf4a/images/icon_note.png) Note This content relates to the Data Mask managed package. Read about Accelerate and Anonymize in [Own from Salesforce](https://help.salesforce.com/s/articleView?id=platform.own_from_salesforce.htm&type=5&language=en_US). ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-deploy_sandboxes-264-0-0-production-enus/654e51d1-6795-49fe-bd43-b5385950cf4a/images/icon_note.png) Note Carefully note certain items during these procedures as required later: Your org’s URL, the generated callback URL, the Consumer Key, and the Consumer Secret. Data Mask leverages the Metadata API to save configuration data. If your organization enabled the session setting Lock sessions to the IP address from which they originated, you can get an Invalid Session ID error. One solution is to disable the session setting, or use a named credential. 1. From Setup, enter External Client Apps in the Quick Find box, then select **Settings** in the External Client App section. 2. Turn on **Allow creation of connected apps**, if it's off. 3. Click **New Connected App**. 4. Complete the fields.

Field	Description
Connected App Name	Data Mask API
API Name	Data_Mask_API
Contact Email	Your email, if you’re the Administrator
Enable OAuth Settings	Select OAuth Settings.
Callback URL	`https://example.com` (to be updated later)
Selected OAuth Scopes	Full Access (full), Perform requests at any time (refresh_token, offline_access)
Require Proof Key for Code Exchange (PKCE) Extension for Supported Authorization Flows	Enable
Require Secret for Web Server Flow	Enable
Require Secret for Refresh Token Flow	Enable

5. Save your changes. 6. To view and record the Consumer Key and Consumer Secret for later use, go to Manage Consumer Details. 7. To create an Auth Provider, from Setup, search for Auth Providers in the search box, and then click **New**. 8. Complete the fields.

Field	Description
Provider Type	Salesforce
Name	Data Mask AP
URL Suffix	Data_Mask_AP
Consumer Key	Use the Consumer Key you noted from the Connected App.
Consumer Secret	Use the Consumer Secret you noted from the Connected App.
Default Scopes	Add full, refresh_token, offline_access. (Don’t use commas to separate.)

9. Save the Auth Provider, and copy the Callback URL to a clipboard. 10. Edit the Connected App to include the Callback URL provided from the Auth Provider that you saved. 11. To create a named credential, from Setup, select Named Credentials **Named Credentials**, click the dropdown arrow next to New, and then select **New Legacy**. 12. Complete the fields.

Field	Description
Label	Data Mask NC
Name	Data_Mask_NC
URL	The specific login URL for your org (not test.salesforce.com or login.salesforce.com)
Identity Type	Named Principal
Authentication Provider	The name of the Auth Provider created earlier
Start Authentication Flow on Save	Enable
Generate Authorization Header	Enable
Allow Merge Fields in HTTP Body	Enable

13. Save the named credential. It’s possible that you must log back into the org and approve the OAuth connection (Allow Access). 14. To update Data Mask Settings, from Setup, search for **Custom Settings**. 15. Locate Find and Manage Masking Configuration, and click **Manage**. 16. Under the Masking Configuration section, click **Edit**, and then enter the name of the named credential Data\_Mask\_NC in the Named Credential field (no spaces allowed). 17. Save the changes. Now, new or existing configurations are changed securely.