---
schema_version: "1"
id: 1681ad2385bea6a18d3c35454251d0063b63a822eeac0ae2f4feae4a6b2d0bf4
title: Define an External Credential and a Named Credential
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/external_services_define_named_credential.md
canonical_url: https://help.salesforce.com/s/articleView?id=platform.external_services_define_named_credential.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 1aba51bcb69f903bda2ba136c3923a0cbf7a66480e00d483cf2d5d73413e218e
description: First, create an external credential to specify an authentication protocol and permission set or profile to use when authenticating to an external system. Second, in order for External Services to authenticate, create a named credential and specify it as the callout endpoint.
products:
  - Salesforce Platform
  - Security
release: "264"
---
# Define an External Credential and a Named Credential

First, create an external credential to specify an authentication protocol and permission set or profile to use when authenticating to an external system. Second, in order for External Services to authenticate, create a named credential and specify it as the callout endpoint.

### Required Editions

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_click-264-0-0-production-enus/5f7d9219-b7b1-4552-8891-f1aba9b289fc/images/icon_important.png)

Important In Winter ’23, Salesforce introduced an improved named credential that is extensible, customizable, and more secure. We strongly recommend that you use this preferred credential instead of legacy named credentials, which are no longer updated or enhanced. For information on extensible, customizable named credentials, see [Named Credentials Schema](https://help.salesforce.com/s/articleView?id=xcloud.nc_parts_of_nc.htm&type=5&language=en_US).

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>All</strong> Editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d163228e67">User Permissions
              Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d163228e67 ">To view named credentials:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d163228e67 ">View Setup and Configuration</td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d163228e67 ">To create, edit, or delete named credentials:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d163228e67 ">Customize Applications</td>

          </tr>
        </tbody>
      </table>

Make sure that you have the OpenAPI endpoint information for the service that you’re registering. You use the endpoint information to set up a named credential. A named credential is the method External Services uses for authentication. A named credential specifies the URL of a callout endpoint (the service you want to access) and its authentication parameters. For example, `https://my_endpoint.example.com`.

If you use OpenAPI 2.0, your endpoint is relative to the base URL. So, if your named credential URL is `https://my_endpoint.example.com` and the basePath is `/basepath`, they combine as the final endpoint of `https://my_endpoint.example.com/basepath`.

If you use OpenAPI 3.0, the named credential URL is composed of the spec’s server URL’s root path. The server’s URL relative path is combined with the named credential’s endpoint. If your named credential URL is `https://my_endpoint.example.com` and the server URL is `https://my_endpoint.example.com/relative/path`, then the server URL’s relative path `relative/path` is combined with the named credentials endpoint `https://my_endpoint.example.com`. You can reuse the same named credentials for external services with the same domain.

For OpenAPI 3.0 schemas, the server URL must be a literal, parseable value. The server URL must be a relative path beginning with a "/" or a fully-qualified URL with a recognized scheme (HTTP or HTTPS), and have no illegal characters. Server variables aren't supported. See [OpenAPI 2.0 and 3.0 Support](https://help.salesforce.com/s/articleView?id=platform.external_services_intro_openapi_2_3_support.htm&type=5&language=en_US).

External Services supports all named credential authoring schemes. OpenAPI security schemes are ignored.

1. [Create and Edit an External Credential](https://help.salesforce.com/s/articleView?id=xcloud.nc_create_edit_external_credential.htm&type=5&language=en_US).
    
    An external credential represents the details of how Salesforce authenticates to an external system via an authentication protocol. It also links to a user’s permission set. Before creating a named credential, create one or more external credentials for it to link to.
2. [Create and Edit a Named Credential](https://help.salesforce.com/s/articleView?id=xcloud.nc_create_edit_named_credential.htm&type=5&language=en_US).
    
    A named credential specifies the URL of a callout endpoint and its required authentication parameters in one definition. A named credential can be specified as an endpoint to simplify the setup of authenticated callouts. Named credentials connect to external credentials.
3. Set up a named credential for the BankService examples in this document.
    
    If you’re creating a named credential to follow the BankService examples, use "legacy" Named Credentials. For these examples, there's no need to set up an external credential. When creating the named credential, select **New Legacy** from the dropdown menu next to the New button instead of clicking **New**. Create the **Name** and enter the **URL**. Don't change any of the other default settings. For more information, see [Define a Legacy Named Credential](https://help.salesforce.com/s/articleView?id=xcloud.named_credentials_define.htm&type=5&language=en_US).

For additional information and configuration details such as per-user authorization, custom headers, and user external credentials, see [Named Credentials and External Credentials](https://help.salesforce.com/s/articleView?id=xcloud.nc_named_creds_and_ext_creds.htm&type=5&language=en_US).