--- schema_version: "1" id: c07ac6e4fa5e3bb26848d29ee55c483f3a5c05607fd1d86e9b6c82c3a6294f6b title: Troubleshooting for Named Credentials collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/nc_troubleshoot.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.nc_troubleshoot.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 640f2854bee52f37801e41b67e9af963cef0a513c7e66422743012abd5851bc5 description: Review the potential causes and troubleshooting steps for common issues that you can encounter when you set up or use named credentials. products: - Security release: "264" --- # Troubleshooting for Named Credentials Review the potential causes and troubleshooting steps for common issues that you can encounter when you set up or use named credentials. ### Required Editions

Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience

Available in: all editions

Issue Potential Causes and Troubleshooting Steps

The external system returns the wrong HTTP response code.

Issue	Potential Causes and Troubleshooting Steps
The external system returns the wrong HTTP response code.	When callouts from Salesforce use invalid or expired credentials, some external systems return non-standard HTTP status codes, such as `400` or `601`, instead of the standard `401` response. To ensure that your callouts work, you can specify other 4`xx`, 6`xx`, 7`xx`, 8`xx`, and 9`xx` HTTP status codes that trigger Salesforce to refresh access tokens. From Setup, use the Quick Find box to find and select Named Credentials. Create or edit an external credential, and in the Additional Status Codes for Token Refresh field, enter the 4`xx` status codes that your external system returns.
Named credential callouts fail.	To perform callouts using a named credential, users need access to: The principal that’s defined in the external credential. See Enable External Credential Principals. The user external credential that holds encrypted tokens to access the target endpoint. Most standard permission sets and profiles have access to the User External Credentials object by default. For the guest user profile, and for some custom permission sets and profiles, you must assign User External Credentials object permissions manually so these users can make authenticated callouts to external systems. See Enable User External Credentials. Without both of these permissions, callouts can fail.
If you create a named credential for an installed managed package, you must allowlist the package’s namespace before it can make callouts. See Allowed Namespaces for Callouts in Create and Edit a Named Credential. Named credentials that are created from Apex code in a managed package are disabled for callouts by default. To allow callouts using these named credentials, go to the named credential in Setup, and then turn on Enabled for Callouts. Be aware of security considerations when enabling callouts for named credentials that originate from Apex.

When callouts from Salesforce use invalid or expired credentials, some external systems return non-standard HTTP status codes, such as 400 or 601, instead of the standard 401 response. To ensure that your callouts work, you can specify other 4xx, 6xx, 7xx, 8xx, and 9xx HTTP status codes that trigger Salesforce to refresh access tokens.

From Setup, use the Quick Find box to find and select Named Credentials. Create or edit an external credential, and in the Additional Status Codes for Token Refresh field, enter the 4xx status codes that your external system returns.

Named credential callouts fail.

To perform callouts using a named credential, users need access to:

The principal that’s defined in the external credential. See Enable External Credential Principals.
The user external credential that holds encrypted tokens to access the target endpoint. Most standard permission sets and profiles have access to the User External Credentials object by default. For the guest user profile, and for some custom permission sets and profiles, you must assign User External Credentials object permissions manually so these users can make authenticated callouts to external systems. See Enable User External Credentials.

Without both of these permissions, callouts can fail.

If you create a named credential for an installed managed package, you must allowlist the package’s namespace before it can make callouts. See Allowed Namespaces for Callouts in Create and Edit a Named Credential.

Named credentials that are created from Apex code in a managed package are disabled for callouts by default. To allow callouts using these named credentials, go to the named credential in Setup, and then turn on Enabled for Callouts. Be aware of security considerations when enabling callouts for named credentials that originate from Apex.

#### See Also - [Named Credentials](https://help.salesforce.com/s/articleView?id=xcloud.named_credentials_about.htm&release=264.0.0&type=5 "Intended to secure and simplify authenticated API callouts to external systems, a named credential specifies the URL of a callout endpoint and its required authentication parameters in one definition. To streamline your Apex code and simplify the setup of authenticated callouts, specify a named credential as the callout endpoint.") - [Create Named Credentials and External Credentials](https://help.salesforce.com/s/articleView?id=xcloud.nc_named_creds_and_ext_creds.htm&release=264.0.0&type=5 "To simplify the setup of authenticated callouts, create an external credential to specify an authentication protocol and then specify a named credential as the callout endpoint. Add custom headers to cover more use cases and security requirements. Use a permission set or profile to grant access so that users can make authenticated callouts. You can create and configure named credentials programmatically or through the Salesforce UI.")