We have a web application developed in Salesforce (apex classes/ triggers and visualforce pages). This web application is talking to our APIs externally using endpoint urls with username and password. As of right now these password/username and endpoint url are being stored in apex classes as constant strings.

In an ASP.Net application or something similar... we would usually store the credential/endpoint url in a web.config file. But in Salesforce where do we store these? I don't want these credential to be easily visible to anyone.


2 Answers 2


Better to use Named Credentials

Named Credentials are a safe and secure way of storing authentication data for external services called from your apex code such as authentication tokens

A named credential specifies the URL of a callout endpoint and its required authentication parameters in one definition. To simplify the setup of authenticated callouts, specify a named credential as the callout endpoint. If you instead specify a URL as the callout endpoint, you must register that URL in your org’s remote site settings and handle the authentication yourself. For example, for an Apex callout, your code would need to handle authentication, which can be less secure and especially complicated for OAuth implementations.

Also, refer Storing Sensitive Data


Use Custom Metadata types to store your credentials.


  • 3
    Not very secure. Named Credentials are a better fit Jun 27, 2017 at 21:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .