---
schema_version: "1"
id: 4f22eed6867cc01ee30e92e38ee6c96bcb03ded1aecf657fc57092805c6147ac
title: Enhanced Security for Named Credentials in Managed Packages
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/260-0-0/rn_security_named_credentials_developer_controlled.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_security_named_credentials_developer_controlled.htm&release=260&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 4a7aac33d11d939acdb27087466c020a88d7b7f4c1c32ead7a992f1e25a6775b
description: By default, as of this announcement, named credentials added to a managed package are now developer controlled and can’t be updated. Therefore, subscribers (customers) can’t edit the named credentials after package installation. This change prevents malicious automation from silently changing the endpoint URL.
products:
  - Cross Cloud Packages Solutions
release: "260"
---
# Enhanced Security for Named Credentials in Managed Packages

By default, as of this announcement, named credentials added to a managed package are now developer controlled and can’t be updated. Therefore, subscribers (customers) can’t edit the named credentials after package installation. This change prevents malicious automation from silently changing the endpoint URL.

**Where:** This change applies to Lightning Experience in Enterprise, Performance, Unlimited, and Developer editions in API version 66.0 and later.

**When:** Salesforce is making this change on a rolling basis starting in February 2026.

**How:** ISVs can explicitly enable editing of specific credentials by subscribers. If a managed package programmatically updates a credential endpoint URL (via Apex or Metadata API), Salesforce automatically disables callouts for that credential. The customer admin must review any endpoint changes to the named credential and manually enable callouts.

#### See Also

- [_Named Credentials Developer Guide_: Update or Delete an OAuth Named Credential](https://developer.salesforce.com/docs/platform/named-credentials/guide/nc-update-delete-oauth-cred.html)
- [_Salesforce Help_: Create or Edit a Named Credential](https://help.salesforce.com/s/articleView?id=xcloud.nc_create_edit_named_credential.htm&type=5&language=en_US)