I want to be able to make callouts to JotForm, but they do not support OAuth and username/password is insufficient for their API. Here are their docs; for reference, here are the 3 auth options:

  1. Authenticate with Query Parameters
  2. Authenticate with HTTP Headers
  3. Authenticate with Javascript SDK

Basically, they provide an API Key and want me to include an apikey parameter in the header. I don't want to hard code it, I don't want to store it as plain text in custom settings/metadata, and this isn't a managed package. Is there any way to securely store/authenticate from Salesforce, ideally using a Named Credential?

I'd love to be able to just have a Named Credential that is just a securely stored, obscured API Key...

1 Answer 1


Well... sort of. The only two officially supported methods are by Basic Authentication and OAuth tokens. That site uses a non-standard API design, so it can't directly benefit from using a Named Credential. "But wait," I hear you say, "you didn't say it wasn't possible." And for that, you'd be correct. Here's what we can do to work within this system's design.

First, go to the New Named Credential screen. Specify the base endpoint ("http://api.jotform.com/"), set the Identity Type to "Named Principle," choose Authentication Protocol "Password Authentication," specify any random user name ("anonymous" should work), and type in the API key as your password. Uncheck "Generate Authorization Header" and check "Allow Merge Fields in HTTP Header", then save this Named Credential.

Now, in your code, you can specify the API key using a merge field:

HttpRequest req = new HttpRequest();
req.setHeader('APIKEY', '{!$Credential.Password}');
HttpResponse res = new Http().send(req);
  • 4
    This is so simple, yet so brilliant! Thank you - confirmed working! (Salesforce really should formalize this hack in some way. Had it not been for you, I probably would have broken down and stored it in a metadata record...)
    – Mike
    May 8, 2018 at 2:50
  • 7
    @Mike Salesforce can do a lot more than it gives credit for in the documentation. As long as I've been doing this, I'm usually inventing new ways to do things that aren't in the documentation.
    – sfdcfox
    May 8, 2018 at 2:59
  • 1
    @Joca As as non-ISV, I have no idea. The ISVforce guide suggests it is, but you'll ultimately need to ask the Partner Support team for a definitive answer.
    – sfdcfox
    Jun 27, 2018 at 20:09
  • 3
    Just a heads up that you actually use $Credential, not the API name of your named credential. I tried {!$My_Named_Credential.Password} with, of course, no luck.
    – evanmcd
    Sep 25, 2020 at 1:31
  • 1
    @NZDev Yes, given the NC is called jotform, then callout:jotform tells Apex you want to use that specific NC, for which the $Credential merge fields will use for populating values. The $variable syntax denote "global" variables that use their context to obtain data, such as $Flow and $User.
    – sfdcfox
    Jan 7 at 13:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.