By default, as of this announcement, named credentials added to a managed package are now developer controlled and can’t be updated. Therefore, subscribers (customers) can’t edit the named credentials after package installation. This change prevents malicious automation from silently changing the endpoint URL.
Where: This change applies to Lightning Experience in Enterprise, Performance, Unlimited, and Developer editions in API version 66.0 and later.
When: Salesforce is making this change on a rolling basis starting in February 2026.
How: ISVs can explicitly enable editing of specific credentials by subscribers. If a managed package programmatically updates a credential endpoint URL (via Apex or Metadata API), Salesforce automatically disables callouts for that credential. The customer admin must review any endpoint changes to the named credential and manually enable callouts.