I want to be able to make callouts to JotForm, but they do not support OAuth and username/password is insufficient for their API. Here are their docs; for reference, here are the 3 auth options:

  1. Authenticate with Query Parameters
  2. Authenticate with HTTP Headers
  3. Authenticate with Javascript SDK

Basically, they provide an API Key and want me to include an apikey parameter in the header. I don't want to hard code it, I don't want to store it as plain text in custom settings/metadata, and this isn't a managed package. Is there any way to securely store/authenticate from Salesforce, ideally using a Named Credential?

I'd love to be able to just have a Named Credential that is just a securely stored, obscured API Key...

2 Answers 2


Well... sort of. The only two officially supported methods are by Basic Authentication and OAuth tokens. That site uses a non-standard API design, so it can't directly benefit from using a Named Credential. "But wait," I hear you say, "you didn't say it wasn't possible." And for that, you'd be correct. Here's what we can do to work within this system's design.

First, go to the New Named Credential screen. Specify the base endpoint ("http://api.jotform.com/"), set the Identity Type to "Named Principle," choose Authentication Protocol "Password Authentication," specify any random user name ("anonymous" should work), and type in the API key as your password. Uncheck "Generate Authorization Header" and check "Allow Merge Fields in HTTP Header", then save this Named Credential.

Now, in your code, you can specify the API key using a merge field:

HttpRequest req = new HttpRequest();
req.setHeader('APIKEY', '{!$Credential.Password}');
HttpResponse res = new Http().send(req);
  • 5
    This is so simple, yet so brilliant! Thank you - confirmed working! (Salesforce really should formalize this hack in some way. Had it not been for you, I probably would have broken down and stored it in a metadata record...)
    – Mike
    Commented May 8, 2018 at 2:50
  • 9
    @Mike Salesforce can do a lot more than it gives credit for in the documentation. As long as I've been doing this, I'm usually inventing new ways to do things that aren't in the documentation.
    – sfdcfox
    Commented May 8, 2018 at 2:59
  • 3
    Just a heads up that you actually use $Credential, not the API name of your named credential. I tried {!$My_Named_Credential.Password} with, of course, no luck.
    – evanmcd
    Commented Sep 25, 2020 at 1:31
  • 2
    How does $credential work, how does it merge in the correct named Credential? Is it because you previously specified it in your setEndpoint('callout:jotform/user') method? The documentation does not explain this setup: developer.salesforce.com/docs/atlas.en-us.apexcode.meta/… Commented Jan 7, 2022 at 11:06
  • 2
    @NZDev Yes, given the NC is called jotform, then callout:jotform tells Apex you want to use that specific NC, for which the $Credential merge fields will use for populating values. The $variable syntax denote "global" variables that use their context to obtain data, such as $Flow and $User.
    – sfdcfox
    Commented Jan 7, 2022 at 13:01

I found this question because I wanted to find out what the best configuration was to make requests to an api that only uses a token in the header as the authentication protocol. The reason I did this research is because I wanted certainty about the correct secure method of storing the token.

This question and sfdcfox's answer were interesting, but with the release of next-generation Named Credentials in 2022, there is now a supported way.

I initially created a Named Credential with an External Credential and added a custom header with Name: . However, it was clear to me that this was not a Salesforce prescribed secure method.

This article confirmed my thoughts.

The correct method to store an API token or key for API request authentication in Salesforce is to store the API Key as an Authentication Parameter in a Permission Set Mapping

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .