---
schema_version: "1"
id: 8164e48a24afd82d07736b0c2331beab10e161e1526aeb14033b547242bf764d
title: Use Custom Headers for Basic Authentication with Named Credentials
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/nc_custom_headers_basic_auth.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.nc_custom_headers_basic_auth.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 5bcb0652312baeb1d326a9e6adf9098964b05dd08eaa98f2bc461db34ef25c56
description: Create an external credential with a custom header that uses HTTP Basic authentication.
products:
  - Security
release: "264"
---
# Use Custom Headers for Basic Authentication with Named Credentials

Create an external credential with a custom header that uses HTTP Basic authentication.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: all editions</td></tr></tbody></table>

The named credentials schema includes support for authentication protocols such as OAuth 2.0 and AWS Signature v4. Some web service providers, however, have their own authentication protocols that use unique headers for authentication. One such protocol is the HTTP Basic authentication scheme, a simple username-password protocol. To connect to an external service using Basic authentication, choose a `Custom` authentication protocol for your external credential, and use a custom header to authenticate.

The HTTP Basic authentication scheme uses the `Authorization` HTTP header, along with a username and password combined using base64 encoding. The username and password are concatenated with a colon (:), then encoded.

![Transforming with base64 (generic)](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/security/images/user_api_access/nc_base64_transform_01.png)

For example:

```
myUsername:myPassword → base64 encoding → bXlVc2VybmFtZTpteVBhc3N3b3JkCg==
```

The username and password can be similarly decoded.

![Decoding with base64 (example)](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/security/images/user_api_access/nc_base64_transform_02.png)

Example:

```
bXlVc2VybmFtZTpteVBhc3N3b3JkCg== → base64 data decoded → myUsername:myPassword
```

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_important.png)

Important

The Basic system _encodes_ the username and password, but it doesn’t _encrypt_ them. Because the username and password can be decoded by anyone who encounters them, the Basic authentication scheme is only secure when used with SSL encryption (HTTPS/TLS).

The encoded Basic data goes in the `Authentication` header as follows.

```
GET https://example.com HTTP/1.1
Authorization: Basic bXlVc2VybmFtZTpteVBhc3N3b3JkCg==
```

## Create a Custom Header for Basic Authentication

Both named and external credentials can have custom credentials. To create a custom header for Basic authentication, use an external credential.

Here’s a general outline of how to use named credentials with a custom `Authorization` header that uses Basic authentication. For more on how to create external credentials with custom headers, see [Create or Edit an External Credential](https://help.salesforce.com/s/articleView?id=xcloud.nc_create_edit_external_credential.htm&release=264.0.0&type=5 "To use named credentials, you must first configure an external credential. The external credential represents the details of how Salesforce authenticates to an external system via an authentication protocol.").

1. Create an external credential. Give it a name such as BasicAuth.
2. Set the credential’s authentication protocol to **Custom**. Save the external credential.
3. Scroll to Principals and click **New**.
    
    The new principal automatically has an identity type of Named Principal, which can’t be changed.
4. Enter a **Parameter Name**, such as Admin or Marketing Group.
5. Optionally, enter a sequence number.
6. Under Authentication Parameters, click **Add** to add a parameter, for example `Username`. Set the value to the username you use for the web service provider. Click **Add** again to add another parameter, for instance `Password`, and set it as the password you use for the web service provider.
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_note.png)
    
    Note Some systems don’t use passwords for Basic authentication. For example, when authenticating to GitHub, you use a personal access token instead of your user password.
    
    ![Authentication parameters for Basic authentication](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/security/images/user_api_access/nc_basic_auth_permset_01.png)
7. Save the principal.
8. Now create a custom header with a formula for an encoded Basic username-password combination. See [Create and Edit Custom Headers](https://help.salesforce.com/s/articleView?id=xcloud.nc_create_custom_headers.htm&release=264.0.0&type=5 "Use custom headers to make unique secure connections to external data sources."). On the external credential, scroll to Custom Headers and click **New**.
9. Enter Authorization as the name of the custom header.
10. For **Value**, enter:
    
    ```
    {!'Basic ' & BASE64ENCODE(BLOB($Credential.externalCredentialName.Username & ':' & $Credential.externalCredentialName.Password))}
    ```
    
    where externalCredentialName is the name of the external credential you created (’BasicAuth’ in this example).
    
    Base64 encoding is often used to convert binary data to a text string for easier transfer between systems. Binary data stored in some databases is sometimes referred to as a Binary Large OBject (BLOB). Two formulas, `BLOB` and `BASE64ENCODE`, used together, take the secret values, treat them as binary data, and then encode that binary data with base64. For more on formula functions like `BASE64ENCODE`, see [Use Named Credential Formula Functions in Custom Headers](https://help.salesforce.com/s/articleView?id=xcloud.nc_named_creds_formula_functions.htm&release=264.0.0&type=5 "Formula functions can be used in the value field of a custom header of a named credential or external credential.").
11. Set the sequence number as desired, or leave the default.
12. Save the custom header.

## Use Basic Authentication with a Named Credential

After you’ve created an external credential that uses custom headers with Basic authentication, link it to a named credential.

These steps describe the general process of linking Basic authentication to a named credential. For full instructions on creating and editing named credentials, see [Create or Edit a Named Credential](https://help.salesforce.com/s/articleView?id=xcloud.nc_create_edit_named_credential.htm&release=264.0.0&type=5 "Configure a named credential to specify the URL of a callout endpoint. To specify the required authentication parameters for the callout, connect the named credential to an external credential.").

1. From [Setup](https://help.salesforce.com/s/articleView?id=xcloud.basics_nav_setup.htm&type=5&language=en_US), use the Quick Find box to find and select **Named Credentials**.
2. Create a new named credential or select an existing one.
3. Disable **Generate Authorization Header** in the named credential. Disabling this option ensures that the named credential uses the custom `Authorization` header that you created.
4. In the named credential, be sure that **Allow Formulas in HTTP Header** is enabled.
5. Enter the name of the external credential that uses Basic authentication.
6. Save the named credential.

A callout using this named credential returns successfully because it has the correct `Authorization` header. If the tokens expire or the URL changes, no changes to Apex code are needed. In addition to Apex, the credential can be used in no-code tools like External Services that provide integration with Flow.

#### See Also

- [Use Custom Headers with Credentials](https://help.salesforce.com/s/articleView?id=xcloud.nc_cred_custom_headers.htm&release=264.0.0&type=5 "Add custom headers to external credentials to cover more use cases and security requirements. With custom headers, you can set your own parameters for authentication.")
- [Calculate Field Values With Formulas](https://help.salesforce.com/s/articleView?id=platform.customize_formuladef.htm&type=5&language=en_US)
- [External Services](https://help.salesforce.com/s/articleView?id=platform.external_services.htm&type=5&language=en_US)
- [Use Flow to Invoke External Service Actions](https://help.salesforce.com/s/articleView?id=platform.enhanced_external_services_example_create_flow.htm&type=5&language=en_US)