---
schema_version: "1"
id: a7a0d3efb584af579634b116088e67e9638337e759f416c427c742c7c30abfc2
title: Update or Delete an OAuth Named Credential
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/security/named-credentials/guides/nc-update-delete-oauth-cred.md
canonical_url: https://developer.salesforce.com/docs/platform/named-credentials/guide/nc-update-delete-oauth-cred.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 21495754d1620366182bdbc5db0925f91db61ddf2c2de0b5b03d0b9d1e618188
products:
  - Named Credentials
  - Security
---
# Update or Delete an OAuth Named Credential

Here are some examples of how you can update or delete a credential from Apex. These code examples reference and build on the Apex code in [Create an OAuth Named Credential](https://developer.salesforce.com/docs/platform/named-credentials/guide/nc-create-oauth-cred.html) which creates a named credential that connects to GitHub.

- [Update](#example-update-an-external-auth-identity-provider) or [delete](#example-delete-an-external-auth-identity-provider) an external auth identity provider
- [Update](#example-update-an-external-credential) or [delete](#example-delete-an-external-credential) an external credential
- [Update](#example-update-a-named-credential) or [delete](#example-delete-a-named-credential) a named credential

For security reasons, if your managed package code (Apex or Metadata API) programmatically updates a named credential, Salesforce automatically disables callouts for that credential. This safety mechanism prevents malicious code from silently redirecting an authenticated connection to an attacker-controlled server.

After your package updates a credential, the connection won’t immediately work. You must instruct the subscriber's admin to turn on the Enabled for Callouts field in the named credential. See [Create or Edit a Named Credential](https://help.salesforce.com/s/articleView?id=xcloud.nc_create_edit_named_credential.htm&type=5) in Salesforce Help.

## Example: Update an External Auth Identity Provider

In this example, the auth provider authorization URL is updated.

```apex
// Create external auth identity provider metadata
ConnectApi.ExternalAuthIdentityProviderInput idpInput = new ConnectApi.ExternalAuthIdentityProviderInput();

String fullName = ‘GitHubProvider’;
idpInput.fullName = fullName;
idpInput.label = fullName;
idpInput.authenticationProtocol = ConnectApi.IdentityProviderAuthProtocol.OAuth;
idpInput.authenticationFlow = ConnectApi.IdentityProviderAuthFlow.AuthorizationCode;
// Update the authorization URL
idpInput.authorizeUrl = 'https://www.test.com/1';
idpInput.tokenUrl = 'https://www.test.com';
idpInput.userInfoUrl = 'https://www.test.com';

ConnectApi.ExternalAuthIdentityProvider actualIdp = ConnectApi.NamedCredentials.updateExternalAuthIdentityProvider(fullName, idpInput);
```

## Example: Update an External Credential

In this example, the external credential’s scope for GitHub access is updated to `full`.

```apex
ConnectApi.ExternalCredentialInput externalCredentialInput = new ConnectApi.ExternalCredentialInput();

externalCredentialInput.developerName = 'GitHubOAuth';
externalCredentialInput.masterLabel = 'GitHub OAuth';
externalCredentialInput.authenticationProtocol = ConnectApi.CredentialAuthenticationProtocol.OAuth;

externalCredentialInput.principals = new List<ConnectApi.ExternalCredentialPrincipalInput>();
externalCredentialInput.parameters = new List<ConnectApi.ExternalCredentialParameterInput>();

// Specify GitHub as the external auth identity provider
ConnectApi.ExternalCredentialParameterInput authProviderParam = new ConnectApi.ExternalCredentialParameterInput();
authProviderParam.parameterName = 'GitHubProvider';
authProviderParam.parameterType = ConnectApi.ExternalCredentialParameterType.ExternalAuthIdentityProvider
authProviderParam.parameterValue = 'GitHubProvider';

externalCredentialInput.parameters.add(authProviderParam);

// Populate principals to connect the external credential to permissions
ConnectApi.ExternalCredentialPrincipalInput principalOne = new ConnectApi.ExternalCredentialPrincipalInput();
principalOne.principalName = 'Developer Access';
principalOne.principalType = ConnectApi.CredentialPrincipalType.PerUserPrincipal;
principalOne.sequenceNumber = 1;
principalOne.parameters = new List<ConnectApi.ExternalCredentialParameterInput>();

// Update the credential-level scope for GitHub access
ConnectApi.ExternalCredentialParameterInput scopeParam = new ConnectApi.ExternalCredentialParameterInput();
scopeParam.parameterName = 'Scope';
scopeParam.parameterType = ConnectApi.ExternalCredentialParameterType.AuthParameter;
scopeParam.parameterValue = 'full';

principalOne.parameters.add(scopeParam);

ConnectApi.ExternalCredentialPrincipalInput principalTwo = new ConnectApi.ExternalCredentialPrincipalInput();
principalTwo.principalName = 'Markdown Access';
principalTwo.principalType = ConnectApi.CredentialPrincipalType.NamedPrincipal;
principalTwo.sequenceNumber = 2;

externalCredentialInput.principals.add(principalOne);
externalCredentialInput.principals.add(principalTwo);

ConnectApi.ExternalCredential updatedEC = ConnectApi.NamedCredentials.updateExternalCredential('GitHubOAuth', externalCredentialInput);

```

## Example: Update a Named Credential

In this example, the named credential’s callout URL is updated.

```apex
ConnectApi.NamedCredentialInput namedCredentialInput = new ConnectApi.NamedCredentialInput();

namedCredentialInput.developerName = 'githubAPI';
namedCredentialInput.masterLabel = 'GitHub API';
namedCredentialInput.type = ConnectApi.NamedCredentialType.SecuredEndpoint;
// Update the callout URL
namedCredentialInput.calloutUrl = ‘https://api.github.com/2';

namedCredentialInput.externalCredentials = new List<ConnectApi.ExternalCredentialInput>();
ConnectApi.ExternalCredentialInput externalCredential = new ConnectApi.ExternalCredentialInput();
externalCredential.developerName = 'GitHubOAuth';
namedCredentialInput.externalCredentials.add(externalCredential);

ConnectApi.NamedCredentialCalloutOptionsInput calloutOptions = new ConnectApi.NamedCredentialCalloutOptionsInput();
calloutOptions.allowMergeFieldsInBody = false;
calloutOptions.allowMergeFieldsInHeader = false;
calloutOptions.generateAuthorizationHeader = true;
namedCredentialInput.calloutOptions = calloutOptions;

ConnectApi.NamedCredential updatedNamedCredential = ConnectApi.NamedCredentials.updateNamedCredential('githubAPI', namedCredentialInput);

```

## Example: Delete an External Auth Identity Provider

```apex
ConnectApi.NamedCredentials.deleteExternalAuthIdentityProvider('GitHubProvider');
```

## Example: Delete an External Credential

```apex
ConnectApi.NamedCredentials.deleteExternalCredential('GitHubOAuth');
```

## Example: Delete a Named Credential

```apex
ConnectApi.NamedCredentials.deleteNamedCredential('githubAPI');
```

### See Also

- _Apex Reference Guide_: [NamedCredentials Methods](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_ConnectAPI_NamedCredentials_static_methods.htm#apex_ConnectAPI_NamedCredentials_methods)