--- schema_version: "1" id: b4efa39803b6a2fe34185051be8b367870301710a4eab9c007277c934be56100 title: Named Credentials Glossary collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/nc_named_credentials_glossary.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.nc_named_credentials_glossary.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 29633062cfcd9582c465baa5a89b014d7412c4b86e65b146509ee1b09ca2a631 description: To better understand named credentials, get familiar with these common terms. products: - Security release: "264" --- # Named Credentials Glossary To better understand named credentials, get familiar with these common terms. ### Required Editions
Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience
Available in: all editions
![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_note.png) Note The phrase named credentials is used throughout the documentation to refer to the broader feature set and architecture described here, including but not limited to, callouts, authentication management, and encrypted token storage. auth. provider Allows third parties to access your org from external services, typically through API integrations. Also referred to as authentication provider. authentication protocol Confirms secure communication between Salesforce and external systems by allowing the receiving party, such as a server, to verify the identity of another party, such as a user logging in on a mobile device. certificate Used for authenticated SSL communications with an external website to verify that a request is coming from your org. You must generate a Salesforce certificate and key pair only if you’re working with an external website that wants verification that a request is coming from a Salesforce org. custom header Provides further authentication parameters on named credentials and external credentials. Custom headers are a way for a remote system to define parameters that it needs as input to respond to a request. See [Use Custom Headers with Credentials](https://help.salesforce.com/s/articleView?id=xcloud.nc_cred_custom_headers.htm&release=264.0.0&type=5 "Add custom headers to external credentials to cover more use cases and security requirements. With custom headers, you can set your own parameters for authentication."). external auth identity provider Links to an external credential and obtains the OAuth tokens necessary for outbound callouts to external systems that use OAuth 2.0 authentication. For seamless integration with multi-tenant services, you can attach account IDs or tenant IDs as custom request parameters. external credential Encapsulates the details of how Salesforce authenticates to a remote system. It specifies the authentication protocol to be used, such as OAuth or AWS Signature v4, and the details needed for that protocol, such as an AWS region. A callout to an external system references a named credential, which in turn links to an external credential. external credential principal Defines which users can use the external credential to make a callout. named credential Specifies the URL of a callout endpoint and its required authentication parameters in one definition. Use a named credential as a callout endpoint instead of hard-coding a URL and authentication information into, for example, Apex code. Named credentials come in three types. SecuredEndpoint The named credential includes an endpoint’s transport protocol as secured through transport layer security (TLS). PrivateEndpoint The named credential sends traffic through a private connection, bypassing the public internet. Legacy A legacy named credential specifies the URL of a callout endpoint and its required authentication parameters in one definition. named principal identity type Describes an external credential principal in which the same credential or authentication configuration is shared by all users in a given org. parameters Used to configure named and external credential callouts through a combination of the type, name, and value and lookup fields. Parameters are used internally to provide a flexible architecture and are exposed in Metadata API, Tooling API, and Connect REST API for packaging reasons. per user identity type Describes an external credential principal that provides access control at the individual user level. With the per user identity type, each Salesforce user manages their own credentials to access the external system. principal The actor that connects to the remote system via callout. The principal can be a single service account or integration user, or in a per-user scenario, an individual human user. Principals are mapped in external credentials to a permission set, profile, or permission set group to grant a set of Salesforce users permission to use that principal in a callout. Other major public cloud providers, such as AWS, also use the term principal to refer to a system process or human user that takes action on a defined resource. user external credential An object that stores encrypted tokens used by named credentials, which are passed to an external system during a callout. Users need the appropriate level of access to this object so the tokens can be read from their secure storage and passed along. Most standard permission sets and profiles have access to the User External Credentials object by default. Named credentials reference external credentials, which specify authentication protocols and information. In turn, external credentials use user external credentials to store encrypted authentication tokens. #### See Also - [Named Credentials](https://help.salesforce.com/s/articleView?id=xcloud.named_credentials_about.htm&release=264.0.0&type=5 "Intended to secure and simplify authenticated API callouts to external systems, a named credential specifies the URL of a callout endpoint and its required authentication parameters in one definition. To streamline your Apex code and simplify the setup of authenticated callouts, specify a named credential as the callout endpoint.") - [Create Named Credentials and External Credentials](https://help.salesforce.com/s/articleView?id=xcloud.nc_named_creds_and_ext_creds.htm&release=264.0.0&type=5 "To simplify the setup of authenticated callouts, create an external credential to specify an authentication protocol and then specify a named credential as the callout endpoint. Add custom headers to cover more use cases and security requirements. Use a permission set or profile to grant access so that users can make authenticated callouts. You can create and configure named credentials programmatically or through the Salesforce UI.") - [Understand Legacy Named Credentials](https://help.salesforce.com/s/articleView?id=xcloud.named_credentials_legacy_about.htm&release=264.0.0&type=5 "A legacy named credential specifies the URL of a callout endpoint and its required authentication parameters in one definition. Legacy named credentials are deprecated and are unsupported in future releases.") - [Authentication Provider SSO](https://help.salesforce.com/s/articleView?id=xcloud.sso_authentication_providers.htm&release=264.0.0&type=5 "With authentication providers, your users can log in to your Salesforce org or Experience Cloud site with single sign-on (SSO) using credentials from a third party. Authentication providers also give your users access to protected third-party data. Salesforce offers several ways to configure authentication providers, such as with OpenID Connect or with a custom OAuth 2.0 configuration. Which protocol you can use depends on the third party.")