Salesforce Docs Portal

Create Named Credentials and External Credentials

To simplify the setup of authenticated callouts, create an external credential to specify an authentication protocol and then specify a named credential as the callout endpoint. Add custom headers to cover more use cases and security requirements. Use a permission set or profile to grant access so that users can make authenticated callouts. You can create and configure named credentials programmatically or through the Salesforce UI.

Required Editions

Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience
Available in: all editions

To create a named credential, follow these steps. To see end-to-end examples of named credential configurations for callouts to various external systems, see Named Credential Example Configurations.

  1. Create or Edit an External Auth Identity Provider
    If you plan to create named and external credentials that use OAuth2.0 authentication, first create an external auth identity provider. External auth identity providers obtain OAuth tokens for outbound callouts to external systems.
  2. Create or Edit an External Credential
    To use named credentials, you must first configure an external credential. The external credential represents the details of how Salesforce authenticates to an external system via an authentication protocol.
  3. Set Up JWT Claims for External Credentials
    If your external credential uses JWT authentication, configure JWT (JSON Web Token) claims.
  4. Use Custom Headers with Credentials
    Add custom headers to external credentials to cover more use cases and security requirements. With custom headers, you can set your own parameters for authentication.
  5. Create or Edit a Named Credential
    Configure a named credential to specify the URL of a callout endpoint. To specify the required authentication parameters for the callout, connect the named credential to an external credential.
  6. Enable External Credential Principals
    Principals link an external credential to permission sets or user profiles so that users can make callouts using the named credential. At run time, Salesforce ensures that the user has the permission set before accessing the remote system.
  7. Enable User External Credentials
    Tokens for named credential callouts are encrypted and stored in the User External Credential object. Any user performing an authenticated callout needs profile- or permission set-based access to user external credentials. Most standard permission sets and profiles have access to the User External Credentials object by default. For the guest user profile, and for some custom permission sets and profiles, you must assign User External Credentials object permissions manually.

See Also