--- schema_version: "1" id: 04e377818bf668d2357c706b9a5ce971280737662bf412ee69ad8656ed6aec23 title: Considerations for Named Credentials collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/nc_considerations.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.nc_considerations.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: c87805d1151f9f7773b7a4152bd2a1745bdb294ba06c205253d974c7e9e465b4 description: Keep these considerations in mind when configuring or working with named credentials. products: - Security release: "264" --- # Considerations for Named Credentials Keep these considerations in mind when configuring or working with named credentials. ### Required Editions
Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience
Available in: all editions
![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_important.png) Important These considerations don’t apply to legacy named credentials. In Winter ’23, Salesforce introduced an improved named credential that’s extensible, customizable, and more secure. We strongly recommend that you use this preferred credential instead of legacy named credentials. ## Sandboxes Sensitive values in named credentials—including access tokens, API keys, and passwords—aren't copied from production environments when you create, refresh, or clone a sandbox org. The named credential parameters and external credential parameters from the production org are included so that you don’t have to recreate them manually in sandboxes. But user external credentials from the production org, which store the encrypted access tokens, aren’t included in cloned or refreshed sandboxes. For example, authentication parameters on an external credential's principal, such as an API key and value or a client ID and client secret, aren’t available in the sandbox. Not including user external credentials in a cloned or refreshed sandbox ensures that the sandbox isn’t connected to external production environments automatically. To test callouts after you create, refresh, or clone a sandbox, you must authenticate or enter credentials for a non-production environment in the external credential. We also recommend reviewing the named credential’s URL to make sure that you’re using the right endpoint for callouts to non-production environments. ## Org Migrations These parts of a named credential are included in org migrations from one instance to another. - Named credential - External credential - Named credential parameters - External credential parameters - User external credentials Because the user external credentials that store encrypted access tokens are included in the migration, Salesforce admins and users don’t reauthenticate to external systems. Users can still use named credentials to make authenticated callouts in the org’s new instance. ## Setup Audit Trail The Setup Audit Trail logs when named credentials and external credentials are created, updated, and deleted in your org. New and changed parameters on named credentials and external credentials are also tracked. For security reasons, the authentication parameters on external credential principals aren’t stored as metadata. The Setup Audit Trail can’t track what changes are made to these parameters or who made the change. #### See Also - [Named Credentials](https://help.salesforce.com/s/articleView?id=xcloud.named_credentials_about.htm&release=264.0.0&type=5 "Intended to secure and simplify authenticated API callouts to external systems, a named credential specifies the URL of a callout endpoint and its required authentication parameters in one definition. To streamline your Apex code and simplify the setup of authenticated callouts, specify a named credential as the callout endpoint.") - [Create Named Credentials and External Credentials](https://help.salesforce.com/s/articleView?id=xcloud.nc_named_creds_and_ext_creds.htm&release=264.0.0&type=5 "To simplify the setup of authenticated callouts, create an external credential to specify an authentication protocol and then specify a named credential as the callout endpoint. Add custom headers to cover more use cases and security requirements. Use a permission set or profile to grant access so that users can make authenticated callouts. You can create and configure named credentials programmatically or through the Salesforce UI.")