4

We have a web application developed in Salesforce (apex classes/ triggers and visualforce pages). This web application is talking to our APIs externally using endpoint urls with username and password. As of right now these password/username and endpoint url are being stored in apex classes as constant strings.

In an ASP.Net application or something similar... we would usually store the credential/endpoint url in a web.config file. But in Salesforce where do we store these? I don't want these credential to be easily visible to anyone.

Improve this question
5

2 Answers 2

Reset to default
9

Better to use Named Credentials

Named Credentials are a safe and secure way of storing authentication data for external services called from your apex code such as authentication tokens

A named credential specifies the URL of a callout endpoint and its required authentication parameters in one definition. To simplify the setup of authenticated callouts, specify a named credential as the callout endpoint. If you instead specify a URL as the callout endpoint, you must register that URL in your org’s remote site settings and handle the authentication yourself. For example, for an Apex callout, your code would need to handle authentication, which can be less secure and especially complicated for OAuth implementations.

Also, refer Storing Sensitive Data

Improve this answer
-2

Use Custom Metadata types to store your credentials.

https://help.salesforce.com/articleView?id=custommetadatatypes_overview.htm&type=0

Improve this answer
1
  • 3
    Not very secure. Named Credentials are a better fit
    – Sebastian Kessel
    Jun 27, 2017 at 21:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .