---
schema_version: "1"
id: 2064e7c50f6950917073f8e4a230fd81b3459c86ec40a13621d1a1b4e39588d2
title: |-
  Custom Headers and Bodies of Apex Callouts That Use Named
      Credentials
collection: legacydeveloper
version: current
locale: en-us
portal_url: https://docs.salesforce.com/legacydeveloper/current/en-us/apexcode/apex_callouts_named_credentials_custom_headers_bodies.md
canonical_url: https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_callouts_named_credentials_custom_headers_bodies.htm
source_site: developer.salesforce.com
content_type: documentation
content_hash: 5c4340de3b2565eb2bcb868b4f5eccb1e67b06a3264940e026949f3bd5e06c4d
description: Salesforce generates a standard authorization header for each callout to a named-credential-defined endpoint, but you can disable this option. Your Apex code can also use merge fields to construct each callout’s HTTP header and body.
---
# Custom Headers and Bodies of Apex Callouts That Use Named Credentials

Salesforce generates a standard authorization header for each callout to a named-credential-defined endpoint, but you can disable this option. Your Apex code can also use merge fields to construct each callout’s HTTP header and body.

This flexibility enables you to use named credentials in special situations. For example, some remote endpoints require security tokens or encrypted credentials in request headers. Some remote endpoints expect usernames and passwords in XML or JSON message bodies. Customize the callout headers and bodies as needed.

The Salesforce admin must set up the named credential to allow Apex code to construct headers or use merge fields in HTTP headers or bodies. The following table describes these callout options for the named credential.

<table class="featureTable sort_table" summary="">


        <thead class="thead sorted" align="left">
          <tr>
            <th class="featureTableHeader  " id="d14436e49">Field</th>

            <th class="featureTableHeader  " id="d14436e52">Description</th>

          </tr>

        </thead>

        <tbody class="tbody">
          <tr>
            <td class="entry" headers="d14436e49" data-title="Field"><span class="keyword parmname"><span class="ph" id="field_generate_authorization_header"><a name="field_generate_authorization_header"><!-- --></a>Generate Authorization
                  Header</span></span></td>

            <td class="entry" headers="d14436e52" data-title="Description">By default, Salesforce generates an authorization header and applies it to each callout
              that references the named credential.<div class="p">Deselect this option only if one of the following
                statements applies.<ul class="ul bulletList">
                  <li class="li">The remote endpoint doesn’t support authorization headers.</li>

                  <li class="li">The authorization headers are provided by other means. For example, in Apex callouts,
                    the developer can have the code construct a custom authorization header for each
                    callout.</li>

                </ul>
              </div>
              <p class="p">This option is required if you reference the named credential from an external
                data source.</p>
            </td>

          </tr>

          <tr>
            <td class="entry" headers="d14436e49" data-title="Field">
              <span class="keyword parmname"><span class="ph" id="field_allow_merge_fields_in_header"><a name="field_allow_merge_fields_in_header"><!-- --></a>Allow Merge Fields in HTTP
                  Header</span></span>
              <p class="p"><span class="keyword parmname"><span class="ph" id="field_allow_merge_fields_in_body"><a name="field_allow_merge_fields_in_body"><!-- --></a>Allow Merge
                    Fields in HTTP Body</span></span></p>
            </td>

            <td class="entry" headers="d14436e52" data-title="Description">In each Apex callout, the code specifies how the HTTP header and request body are
              constructed. For example, the Apex code can set the value of a cookie in an authorization
              header.<p class="p">These options enable the Apex code to use merge fields to populate the HTTP header
                and request body with org data when the callout is made.</p>
              <p class="p">These options aren’t
                available if you reference the named credential from an external data source.</p>
            </td>

          </tr>

        </tbody>

      </table>

- [Next →](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_callouts_named_credentials_merge_fields.htm "Merge Fields for Apex Callouts That Use Named Credentials")

#### See Also

- [Merge Fields for Apex Callouts That Use Named Credentials](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_callouts_named_credentials_merge_fields.htm "To construct the HTTP headers and request bodies of callouts to endpoints that are specified as named credentials, use these merge fields in your Apex code.")
- [_Salesforce Help_: Named Credentials](https://help.salesforce.com/HTViewHelpDoc?id=named_credentials_about.htm&language=en_US "Salesforce Help: Named Credentials - HTML (New Window)")