Encrypting credentials in Apex Callout class

Question

I am sending a SOAP request to an external system. The authentication mechanism requires me to send the username and password in the HTTP request header.

To add it to request header I have to hard code the username and password in my apex callout class. like below:

obj.inputHttpHeaders_x = new Map<String, String>();
String username = 'xyz';
String password = 'passwordIsthis';
Blob headerValue = Blob.valueOf(username + ':' + password);
String authorizationHeader = 'BASIC ' + EncodingUtil.base64Encode(headerValue);    
obj.inputHttpHeaders_x.put('Authorization', authorizationHeader);

Is there a way not to hard code the value of username and password in the above piece of code? I do not want any one to see the credential here as it is not a good practice. Any advice?

Answer 1

Yes there is a way. Salesforce allows you to link callout urls to credentials.

Here's the Named Credentials documentation.

Answer 2

Another option, if this is for a managed package, is to store the credentials in a protected custom setting. You will need to provide a page within the managed package to set the values in the protected custom setting, as they will only be accessible from the code in that package.

See Accessing Custom Settings