We have a web application developed in Salesforce (apex classes/ triggers and visualforce pages). This web application is talking to our APIs externally using endpoint urls with username and password. As of right now these password/username and endpoint url are being stored in apex classes as constant strings.

In an ASP.Net application or something similar... we would usually store the credential/endpoint url in a web.config file. But in Salesforce where do we store these? I don't want these credential to be easily visible to anyone.


Better to use Named Credentials

Named Credentials are a safe and secure way of storing authentication data for external services called from your apex code such as authentication tokens

A named credential specifies the URL of a callout endpoint and its required authentication parameters in one definition. To simplify the setup of authenticated callouts, specify a named credential as the callout endpoint. If you instead specify a URL as the callout endpoint, you must register that URL in your org’s remote site settings and handle the authentication yourself. For example, for an Apex callout, your code would need to handle authentication, which can be less secure and especially complicated for OAuth implementations.

Also, refer Storing Sensitive Data


Use Custom Metadata types to store your credentials.


  • 3
    Not very secure. Named Credentials are a better fit – Sebastian Kessel Jun 27 '17 at 21:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.