I am sending a SOAP request to an external system. The authentication mechanism requires me to send the username and password in the HTTP request header.

To add it to request header I have to hard code the username and password in my apex callout class. like below:

obj.inputHttpHeaders_x = new Map<String, String>();
String username = 'xyz';
String password = 'passwordIsthis';
Blob headerValue = Blob.valueOf(username + ':' + password);
String authorizationHeader = 'BASIC ' + EncodingUtil.base64Encode(headerValue);    
obj.inputHttpHeaders_x.put('Authorization', authorizationHeader);

Is there a way not to hard code the value of username and password in the above piece of code? I do not want any one to see the credential here as it is not a good practice. Any advice?

2 Answers 2


Yes there is a way. Salesforce allows you to link callout urls to credentials.

Here's the Named Credentials documentation.


Another option, if this is for a managed package, is to store the credentials in a protected custom setting. You will need to provide a page within the managed package to set the values in the protected custom setting, as they will only be accessible from the code in that package.

See Accessing Custom Settings

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .