Update or Delete an OAuth Named Credential

Here are some examples of how you can update or delete a credential from Apex. These code examples reference and build on the Apex code in Create an OAuth Named Credential which creates a named credential that connects to GitHub.

Update or delete an external auth identity provider
Update or delete an external credential
Update or delete a named credential

For security reasons, if your managed package code (Apex or Metadata API) programmatically updates a named credential, Salesforce automatically disables callouts for that credential. This safety mechanism prevents malicious code from silently redirecting an authenticated connection to an attacker-controlled server.

After your package updates a credential, the connection won’t immediately work. You must instruct the subscriber's admin to turn on the Enabled for Callouts field in the named credential. See Create or Edit a Named Credential in Salesforce Help.

Example: Update an External Auth Identity Provider

In this example, the auth provider authorization URL is updated.

// Create external auth identity provider metadata
ConnectApi.ExternalAuthIdentityProviderInput idpInput = new ConnectApi.ExternalAuthIdentityProviderInput();

String fullName = ‘GitHubProvider’;
idpInput.fullName = fullName;
idpInput.label = fullName;
idpInput.authenticationProtocol = ConnectApi.IdentityProviderAuthProtocol.OAuth;
idpInput.authenticationFlow = ConnectApi.IdentityProviderAuthFlow.AuthorizationCode;
// Update the authorization URL
idpInput.authorizeUrl = 'https://www.test.com/1';
idpInput.tokenUrl = 'https://www.test.com';
idpInput.userInfoUrl = 'https://www.test.com';

ConnectApi.ExternalAuthIdentityProvider actualIdp = ConnectApi.NamedCredentials.updateExternalAuthIdentityProvider(fullName, idpInput);

Example: Update an External Credential

In this example, the external credential’s scope for GitHub access is updated to full.

ConnectApi.ExternalCredentialInput externalCredentialInput = new ConnectApi.ExternalCredentialInput();

externalCredentialInput.developerName = 'GitHubOAuth';
externalCredentialInput.masterLabel = 'GitHub OAuth';
externalCredentialInput.authenticationProtocol = ConnectApi.CredentialAuthenticationProtocol.OAuth;

externalCredentialInput.principals = new List<ConnectApi.ExternalCredentialPrincipalInput>();
externalCredentialInput.parameters = new List<ConnectApi.ExternalCredentialParameterInput>();

// Specify GitHub as the external auth identity provider
ConnectApi.ExternalCredentialParameterInput authProviderParam = new ConnectApi.ExternalCredentialParameterInput();
authProviderParam.parameterName = 'GitHubProvider';
authProviderParam.parameterType = ConnectApi.ExternalCredentialParameterType.ExternalAuthIdentityProvider
authProviderParam.parameterValue = 'GitHubProvider';

externalCredentialInput.parameters.add(authProviderParam);

// Populate principals to connect the external credential to permissions
ConnectApi.ExternalCredentialPrincipalInput principalOne = new ConnectApi.ExternalCredentialPrincipalInput();
principalOne.principalName = 'Developer Access';
principalOne.principalType = ConnectApi.CredentialPrincipalType.PerUserPrincipal;
principalOne.sequenceNumber = 1;
principalOne.parameters = new List<ConnectApi.ExternalCredentialParameterInput>();

// Update the credential-level scope for GitHub access
ConnectApi.ExternalCredentialParameterInput scopeParam = new ConnectApi.ExternalCredentialParameterInput();
scopeParam.parameterName = 'Scope';
scopeParam.parameterType = ConnectApi.ExternalCredentialParameterType.AuthParameter;
scopeParam.parameterValue = 'full';

principalOne.parameters.add(scopeParam);

ConnectApi.ExternalCredentialPrincipalInput principalTwo = new ConnectApi.ExternalCredentialPrincipalInput();
principalTwo.principalName = 'Markdown Access';
principalTwo.principalType = ConnectApi.CredentialPrincipalType.NamedPrincipal;
principalTwo.sequenceNumber = 2;

externalCredentialInput.principals.add(principalOne);
externalCredentialInput.principals.add(principalTwo);

ConnectApi.ExternalCredential updatedEC = ConnectApi.NamedCredentials.updateExternalCredential('GitHubOAuth', externalCredentialInput);

Example: Update a Named Credential

In this example, the named credential’s callout URL is updated.

ConnectApi.NamedCredentialInput namedCredentialInput = new ConnectApi.NamedCredentialInput();

namedCredentialInput.developerName = 'githubAPI';
namedCredentialInput.masterLabel = 'GitHub API';
namedCredentialInput.type = ConnectApi.NamedCredentialType.SecuredEndpoint;
// Update the callout URL
namedCredentialInput.calloutUrl = ‘https://api.github.com/2';

namedCredentialInput.externalCredentials = new List<ConnectApi.ExternalCredentialInput>();
ConnectApi.ExternalCredentialInput externalCredential = new ConnectApi.ExternalCredentialInput();
externalCredential.developerName = 'GitHubOAuth';
namedCredentialInput.externalCredentials.add(externalCredential);

ConnectApi.NamedCredentialCalloutOptionsInput calloutOptions = new ConnectApi.NamedCredentialCalloutOptionsInput();
calloutOptions.allowMergeFieldsInBody = false;
calloutOptions.allowMergeFieldsInHeader = false;
calloutOptions.generateAuthorizationHeader = true;
namedCredentialInput.calloutOptions = calloutOptions;

ConnectApi.NamedCredential updatedNamedCredential = ConnectApi.NamedCredentials.updateNamedCredential('githubAPI', namedCredentialInput);

Example: Delete an External Auth Identity Provider

ConnectApi.NamedCredentials.deleteExternalAuthIdentityProvider('GitHubProvider');

Example: Delete an External Credential

ConnectApi.NamedCredentials.deleteExternalCredential('GitHubOAuth');

Example: Delete a Named Credential

ConnectApi.NamedCredentials.deleteNamedCredential('githubAPI');