I have a named credential as follows:

Name   Test_Credential
URL    https://www.somesite.com
Identity Type    Named Principal
Authentication Protocol    Password Authentication
Username   foobar
Password   mySomeSiteDeveloperKey
Generate Authorization Header   FALSE
Allow Merge Fields in HTTP Header    TRUE
Allow Merge Fields in HTTP Body     TRUE

The service that I am trying to authenticate against uses URL parameters to pass in the developer key and username. Is there any way to use Named Credential Merge Fields to pass those in to the URL?

The Named Credential attributes seem not to get decoded until the request is actually sent, as debugging the endpoint, or headers if I set them per the linked doc, show the un-merged data. I can get the callout to go to the right place, and return the expected error because the auth information is not provided. Anybody know of a "show me my HTTP request" site that I could point to to get a better idea of how this works?

I've tried both of these:


req.setEndpoint('callout:Test_Credential/api/action' + '?id=' + '{!$Credential.Password}' + '&account=' + '{!$Credential.UserName}');

(Edited to remove the part about $Credential vs. $Test_Credential as I was able to determine that it is the former, and see the merged creds by calling out to this page.)

1 Answer 1


You can only use merge fields within setHeader and setBody, as the options specify. This may mean that you need to use POST with application/x-www-form-urlencoded, or arrange for a specific header to be understood by the server. Your server should NOT be accepting usernames and passwords in the query string, as this is a major security risk.

  • Thanks, I feared this was the case. You're of course correct that auth via URL params is garbage, but I'm just trying to consume this webapp's documented API; I didn't make it. :-) Commented Aug 31, 2016 at 21:03
  • Hi Thomas, are you able to use merge fields in url.. I am trying something similar
    – sf_user
    Commented May 28, 2017 at 2:11
  • a valid use case for this is trying to connect with an API that expects the key in the URL (EG google places) and wanting to store the API key in the password field. Salesforce should just allow encrypted env vars...
    – NSjonas
    Commented Nov 16, 2018 at 19:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .