I have seen people use auth. providers that has client secret and id of connected app and authenticated using named credentials. The named credentials stores the oauth refresh token but I am not getting why this flow is needed or what do we gain here.

All suggestions appreciated.


From the Named Credentials documentation, an important summary:

By separating the endpoint URL and authentication from the callout definition, named credentials make callouts easier to maintain. For example, if an endpoint URL changes, you update only the named credential. All callouts that reference the named credential simply continue to work.

Named Credentials insulate your code from specific endpoint URLs and from authentication details, and also provide secure storage for secret authentication parameters. The latter is a capability that is otherwise only possible by using a Protected Custom Setting in a managed package, which not every org has the capacity or inclination to do. Otherwise, you're stuck with storing highly sensitive authentication parameters, such as OAuth refresh tokens, in locations where anyone with View Setup and Configuration permission can get at them. Named Credentials makes that security problem go away.

Put shortly, they abstract away a lot of complex, difficult, and risky (from a security standpoint) implementation details so that your code doesn't have to handle them, and they improve the maintainability and security of your outbound connections.


I have written an article on why and how to use this with Google API! No need for an Auth handler apex class or visualforce page. Everything is handled by Salesforce. You don't have to bother with authentication.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.