Salesforce Named Credentials: Complete Guide
Quick Summary:
Named Credentials let Salesforce securely authenticate to external systems without hardcoding credentials in Apex or Flow -- the outbound counterpart to Connected Apps.
What Is a Named Credential?
A Named Credential stores the authentication details and endpoint URL needed for Salesforce to make an authenticated call out to an external system -- an API, a third-party service -- without that credential ever being exposed in code, logs, or debug output. This is the standard, secure way to handle outbound integrations.
How to Set One Up
Go to Setup → Named Credentials and click New.
Enter the external endpoint URL and select the authentication protocol (OAuth, Basic Auth, etc.).
Configure the specific authentication details required by that protocol.
Save, then reference the Named Credential by name in Apex callouts or Flow HTTP Callout actions.
Referencing in Apex
HttpRequest req = new HttpRequest();
req.setEndpoint('callout:My_Named_Credential/api/v1/data');
req.setMethod('GET');A Real-World Example
A Flow needs to send order data to an external shipping provider's API whenever an Opportunity closes. Rather than embedding an API key directly in the Flow (a security risk, and hard to rotate), a Named Credential handles authentication securely, and the Flow's HTTP Callout action simply references it by name.
💡 Pro Tip
Use the newer External Credentials model (separating authentication from endpoint) for anything you expect to reuse across multiple integrations pointing at the same authenticated system -- it avoids duplicating credential configuration.
Frequently Asked Questions
What\'s the difference between Named Credentials and Connected Apps?
Connected Apps control how external systems authenticate INTO Salesforce; Named Credentials control how Salesforce authenticates OUT to external systems -- they solve opposite directions of the same integration problem.
Do Named Credentials store passwords in plain text?
No, authentication details are securely stored and never exposed in Apex code or logs -- this is the core security benefit of using Named Credentials over hardcoding credentials.
Can Named Credentials be used with Flow, not just Apex?
Yes, Flow's HTTP Callout action can reference a Named Credential directly, letting declarative automation make authenticated external calls without any code.
What authentication types do Named Credentials support?
Several, including OAuth 2.0, Basic Authentication, AWS Signature, and JWT bearer, depending on what the external system requires.
Can multiple users share one Named Credential\'s authentication?
Yes, with per-org authentication (as opposed to per-user), all users can make callouts through a single shared identity, useful for system-level integrations.
What\'s an External Credential and how does it relate to Named Credentials?
External Credentials (the newer model) separate the authentication configuration from the endpoint configuration, giving more flexibility -- a Named Credential can reference an External Credential rather than bundling everything together.
Why does my callout fail with an authentication error even though the Named Credential looks correct?
Common causes include an expired OAuth token, incorrect scopes on the underlying Connected App (if using OAuth), or the external system's credentials having been rotated without updating the Named Credential.
Can Named Credentials bypass Salesforce\'s remote site settings requirement?
Yes, a properly configured Named Credential automatically handles the endpoint authorization that would otherwise require a separate Remote Site Setting.
Are Named Credentials required for all external HTTP callouts?
Not strictly required for simple, unauthenticated callouts, but strongly recommended for anything requiring authentication -- the alternative is managing credentials manually in code, which is far less secure.
Can I test a Named Credential\'s connection before using it in code?
Testing typically happens by making an actual callout through it in a sandbox first, since there's no dedicated "test connection" button in the standard setup UI.