---
schema_version: "1"
id: fe29eab5e033caa63dece4d6186ee67d98737da6886883497a60a5277f690349
title: Merge Fields for Apex Callouts That Use Named Credentials
collection: legacydeveloper
version: current
locale: en-us
portal_url: https://docs.salesforce.com/legacydeveloper/current/en-us/apexcode/apex_callouts_named_credentials_merge_fields.md
canonical_url: https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_callouts_named_credentials_merge_fields.htm
source_site: developer.salesforce.com
content_type: documentation
content_hash: 81c853bba84fde6a4f738b05ebcfd73ce3618a5fe1d6098581d352f0cb3e8b51
description: To construct the HTTP headers and request bodies of callouts to endpoints that are specified as named credentials, use these merge fields in your Apex code.
---
# Merge Fields for Apex Callouts That Use Named Credentials

To construct the HTTP headers and request bodies of callouts to endpoints that are specified as named credentials, use these merge fields in your Apex code.

<table class="featureTable sort_table" summary="">


        <thead class="thead sorted" align="left">
          <tr>
            <th class="featureTableHeader  " id="d14684e60">Merge Field</th>

            <th class="featureTableHeader  " id="d14684e63">Description</th>

          </tr>

        </thead>

        <tbody class="tbody">
          <tr>
            <td class="entry" headers="d14684e60" data-title="Merge Field">
              <samp class="codeph nolang">{!$Credential.Username}</samp>
              <p class="p"><samp class="codeph nolang">{!$Credential.Password}</samp></p>
            </td>

            <td class="entry" headers="d14684e63" data-title="Description">Username and password of the running user. Available only if the named credential uses
              password authentication. For an example, see <a class="xref" href="#ex_username_password">Non-standard authentication with username and password</a>.</td>

          </tr>

          <tr>
            <td class="entry" headers="d14684e60" data-title="Merge Field"><samp class="codeph nolang">{!$Credential.OAuthToken}</samp></td>

            <td class="entry" headers="d14684e63" data-title="Description">OAuth token of the running user. <span class="ph" id="named_credential_available_only_oauth"><a name="named_credential_available_only_oauth"><!-- --></a>Available only if the named credential uses OAuth
                authentication.</span> For an example, see <a class="xref" href="#ex_oauth_token">OAuth authentication</a>.</td>

          </tr>

          <tr>
            <td class="entry" headers="d14684e60" data-title="Merge Field"><samp class="codeph nolang">{!$Credential.AuthorizationMethod}</samp></td>

            <td class="entry" headers="d14684e63" data-title="Description">
              <span class="ph" id="named_credential_valid_values_depend_authentication"><a name="named_credential_valid_values_depend_authentication"><!-- --></a>Valid values depend on the
                authentication protocol of the named credential.</span>
              <ul class="ul bulletList">
                <li class="li">
                  <samp class="codeph nolang">Basic</samp>—password authentication
                </li>

                <li class="li">
                  <samp class="codeph nolang">Bearer</samp>—OAuth 2.0
                </li>

                <li class="li">
                  <samp class="codeph nolang">null</samp>—no authentication
                </li>

              </ul>
            </td>

          </tr>

          <tr>
            <td class="entry" headers="d14684e60" data-title="Merge Field"><samp class="codeph nolang">{!$Credential.AuthorizationHeaderValue}</samp></td>

            <td class="entry" headers="d14684e63" data-title="Description">Valid values depend on the authentication protocol of the named credential. <ul class="ul bulletList">
                <li class="li">
                  <var class="keyword varname">Base-64 encoded username and password</var>—password authentication
                </li>

                <li class="li">
                  <var class="keyword varname">OAuth token</var>—OAuth 2.0
                </li>

                <li class="li">
                  <samp class="codeph nolang">null</samp>—no authentication
                </li>

              </ul>
            </td>

          </tr>

          <tr>
            <td class="entry" headers="d14684e60" data-title="Merge Field"><samp class="codeph nolang">{!$Credential.OAuthConsumerKey}</samp></td>

            <td class="entry" headers="d14684e63" data-title="Description">Consumer key. Available only if the named credential uses OAuth authentication.</td>

          </tr>

        </tbody>

      </table>

## Using {!$Credential.Username} and {!$Credential.Password} for non-standard authentication

// non-standard authentication
req.setHeader('X-Username', '{!$Credential.Username}');
req.setHeader('X-Password', '{!$Credential.Password}');

## Using {!$Credential.OAuthToken} for OAuth authentication

req.setHeader('Authorization', '{!$Credential.OAuthToken}');

When you use merge fields to construct HTTP headers and request bodies, keep these considerations in mind.

- To allow Apex code to use merge fields to populate the HTTP header and request body with org data when the callout is made, a Salesforce admin must enable **Allow Merge Fields in HTTP Header** and **Allow Merge Fields in HTTP Body** on the named credential. See [Create or Edit a Named Credential](https://help.salesforce.com/s/articleView?id=sf.nc_create_edit_named_credential.htm&language=en_US) in Salesforce Help.
- To access or input custom headers, use Connect REST API. See [Named Credentials Resources](https://developer.salesforce.com/docs/atlas.en-us.264.0.chatterapi.meta/chatterapi/connect_resources_named_credentials_resources.htm "HTML (New Window)") in the Connect REST API Developer Guide.
- When you use these merge fields in HTTP request bodies of callouts, you can apply the HTMLENCODE formula function to escape special characters. The formula must start with HTMLENCODE, and other formula functions aren't supported. HTMLENCODE can’t be used on merge fields in HTTP headers. This example escapes special characters that are in the credentials.
    
    req.setBody('Username:{!HTMLENCODE($Credential.Username)}')
    req.setBody('Password:{!HTMLENCODE($Credential.Password)}')
- When you use these merge fields in SOAP API calls, OAuth access tokens aren’t refreshed.

- [← Previous](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_callouts_named_credentials_custom_headers_bodies.htm "Custom Headers and Bodies of Apex Callouts That Use Named Credentials")

#### See Also

- [Custom Headers and Bodies of Apex Callouts That Use Named Credentials](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_callouts_named_credentials_custom_headers_bodies.htm "Salesforce generates a standard authorization header for each callout to a named-credential-defined endpoint, but you can disable this option. Your Apex code can also use merge fields to construct each callout’s HTTP header and body.")
- [Named Credentials as Callout Endpoints](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_callouts_named_credentials.htm "A named credential specifies the URL of a callout endpoint and its required authentication parameters in one definition. Salesforce manages all authentication for Apex callouts that specify a named credential as the callout endpoint so that your code doesn’t have to. You can also skip remote site settings, which are otherwise required for callouts to external sites, for the site defined in the named credential.")
- [_Knowledge Article_: Named credential OAuth token doesn't get automatically refreshed with Salesforce SOAP API endpoint](https://help.salesforce.com/articleView?id=Named-credential-oauth-token-doesn-t-get-automatically-refreshed-with-Salesforce-SOAP-API-end-point&type=1&language=en_US "Knowledge Article: Named credential OAuth token doesn't get
    automatically refreshed with Salesforce SOAP API endpoint - HTML (New Window)")