4

I have a named credential as follows:

Name   Test_Credential
URL    https://www.somesite.com
Identity Type    Named Principal
Authentication Protocol    Password Authentication
Username   foobar
Password   mySomeSiteDeveloperKey
Generate Authorization Header   FALSE
Allow Merge Fields in HTTP Header    TRUE
Allow Merge Fields in HTTP Body     TRUE

The service that I am trying to authenticate against uses URL parameters to pass in the developer key and username. Is there any way to use Named Credential Merge Fields to pass those in to the URL?

The Named Credential attributes seem not to get decoded until the request is actually sent, as debugging the endpoint, or headers if I set them per the linked doc, show the un-merged data. I can get the callout to go to the right place, and return the expected error because the auth information is not provided. Anybody know of a "show me my HTTP request" site that I could point to to get a better idea of how this works?

I've tried both of these:

req.setEndpoint('callout:Test_Credential/api/action?id={!$Credential.Password}&account={!$Credential.UserName}');

req.setEndpoint('callout:Test_Credential/api/action' + '?id=' + '{!$Credential.Password}' + '&account=' + '{!$Credential.UserName}');

(Edited to remove the part about $Credential vs. $Test_Credential as I was able to determine that it is the former, and see the merged creds by calling out to this page.)

3

You can only use merge fields within setHeader and setBody, as the options specify. This may mean that you need to use POST with application/x-www-form-urlencoded, or arrange for a specific header to be understood by the server. Your server should NOT be accepting usernames and passwords in the query string, as this is a major security risk.

  • Thanks, I feared this was the case. You're of course correct that auth via URL params is garbage, but I'm just trying to consume this webapp's documented API; I didn't make it. :-) – Thomas Taylor Aug 31 '16 at 21:03
  • Hi Thomas, are you able to use merge fields in url.. I am trying something similar – sf_user May 28 '17 at 2:11
  • a valid use case for this is trying to connect with an API that expects the key in the URL (EG google places) and wanting to store the API key in the password field. Salesforce should just allow encrypted env vars... – NSjonas Nov 16 '18 at 19:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.